From c8ba6c9c83ead882f7161f5cddfc1623111c2ce8 Mon Sep 17 00:00:00 2001 From: Kevin Ledesma Date: Thu, 26 Jan 2023 08:33:20 -0300 Subject: [PATCH 01/34] fix(#3328): update auth messages to new payload --- .../data/wazuh_enrollment_tests.yaml | 38 +++++++++---------- .../integration/test_enrollment/enrollment.py | 3 +- 2 files changed, 20 insertions(+), 21 deletions(-) diff --git a/tests/integration/test_enrollment/data/wazuh_enrollment_tests.yaml b/tests/integration/test_enrollment/data/wazuh_enrollment_tests.yaml index 228285620f..9d66783b8a 100644 --- a/tests/integration/test_enrollment/data/wazuh_enrollment_tests.yaml +++ b/tests/integration/test_enrollment/data/wazuh_enrollment_tests.yaml @@ -4,7 +4,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - name: "Valid agent address" @@ -14,7 +14,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' IP:'192.168.0.10'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'192.168.0.10'\n" response: "OSSEC K:'001 {host_name} 192.168.0.10 TopSecret'\n" - name: "Valid agent address CIDR" @@ -24,7 +24,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' IP:'192.168.0.10/24'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'192.168.0.10/24'\n" response: "OSSEC K:'001 {host_name} 192.168.0.10/24 TopSecret'\n" - name: "Invalid Agent address CIDR" @@ -73,7 +73,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - name: "Groups" @@ -83,7 +83,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' G:'group_1'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0' G:'group_1'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - name: "Multi Groups" @@ -93,7 +93,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' G:'group_1,group_2'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0' G:'group_1,group_2'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - name: "Invalid enabled" @@ -113,7 +113,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'test_agent'\n" + expected: "OSSEC A:'test_agent' V:'v4.5.0'\n" response: "OSSEC K:'001 test_agent any TopSecret'\n" - name: "Valid agent name config max length" @@ -123,7 +123,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn'\n" + expected: "OSSEC A:'nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn' V:'v4.5.0'\n" response: "OSSEC K:'001 nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn any TopSecret'\n" - name: "Invalid agent name config" @@ -157,7 +157,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' IP:'src'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'src'\n" response: "OSSEC K:'001 {host_name} 192.168.0.10 TopSecret'\n" - name: "Incompatible - Use source IP" @@ -191,7 +191,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC PASS: pass123 OSSEC A:'{host_name}'\n" + expected: "OSSEC PASS: pass123 OSSEC A:'{host_name}' V:'v4.5.0'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - name: "Password from file - Agent-Auth" @@ -202,7 +202,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC PASS: pass_from_file OSSEC A:'{host_name}'\n" + expected: "OSSEC PASS: pass_from_file OSSEC A:'{host_name}' V:'v4.5.0'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - name: "Password from file - Agentd" @@ -215,7 +215,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC PASS: pass_from_file OSSEC A:'{host_name}'\n" + expected: "OSSEC PASS: pass_from_file OSSEC A:'{host_name}' V:'v4.5.0'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - name: "Valid port" @@ -227,7 +227,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - name: "Invalid port 65536" @@ -265,7 +265,7 @@ pre_existent_keys: - "001 test_name any TopSecret" message: - expected: "OSSEC A:'{host_name}' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - @@ -276,7 +276,7 @@ pre_existent_keys: - "001 test_name any TopSecret" message: - expected: "OSSEC A:'{host_name}' IP:'192.168.0.10' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'192.168.0.10' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" response: "OSSEC K:'001 {host_name} 192.168.0.10 TopSecret' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" - name: "Groups with key hash" @@ -286,7 +286,7 @@ pre_existent_keys: - "001 test_name any TopSecret" message: - expected: "OSSEC A:'{host_name}' G:'group_1' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0' G:'group_1' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - name: "Valid agent IPv6 address" @@ -296,7 +296,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' IP:'02DB:4660:46AF:E523:D05E:A62E:4CA7:8E58'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'02DB:4660:46AF:E523:D05E:A62E:4CA7:8E58'\n" response: "OSSEC K:'001 {host_name} 02DB:4660:46AF:E523:D05E:A62E:4CA7:8E58 TopSecret'\n" - name: "Valid compressed agent IPv6 address" @@ -306,7 +306,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' IP:'2001:0DB8:0000:000B:0000:0000:0000:001A'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'2001:0DB8:0000:000B:0000:0000:0000:001A'\n" response: "OSSEC K:'001 {host_name} 2001:0DB8:0000:000B:0000:0000:0000:001A TopSecret'\n" - name: "Invalid Agent IPv6 address double colon" @@ -332,7 +332,7 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}'\n" + expected: "OSSEC A:'{host_name}' V:'v4.5.0'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - name: "Invalid long agent IPv6 address" diff --git a/tests/integration/test_enrollment/enrollment.py b/tests/integration/test_enrollment/enrollment.py index 3d145ca3d4..1b977dbcde 100644 --- a/tests/integration/test_enrollment/enrollment.py +++ b/tests/integration/test_enrollment/enrollment.py @@ -51,5 +51,4 @@ def launch_agent_auth(configuration): if configuration.get('groups'): parser.add_groups(configuration.get('groups')) - out = subprocess.Popen(parser.get_command(), stdout=subprocess.PIPE, stderr=subprocess.STDOUT) - out.communicate(timeout=AGENT_AUTH_LAUNCH_TIMEOUT) + out = subprocess.call(parser.get_command(), timeout=AGENT_AUTH_LAUNCH_TIMEOUT) From 71e03f4d1f2dbbf49f5481dfea3d1f51c6980153 Mon Sep 17 00:00:00 2001 From: Kevin Ledesma Date: Thu, 26 Jan 2023 10:58:28 -0300 Subject: [PATCH 02/34] fix(#4022): replace Popen() with call() ensuring process killing --- tests/integration/test_enrollment/enrollment.py | 3 +-- .../test_wazuh_db/data/global/global_messages.yaml | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/tests/integration/test_enrollment/enrollment.py b/tests/integration/test_enrollment/enrollment.py index 1b977dbcde..24eda59dc0 100644 --- a/tests/integration/test_enrollment/enrollment.py +++ b/tests/integration/test_enrollment/enrollment.py @@ -8,7 +8,6 @@ import subprocess -import os import platform from wazuh_testing.agent import AgentAuthParser @@ -51,4 +50,4 @@ def launch_agent_auth(configuration): if configuration.get('groups'): parser.add_groups(configuration.get('groups')) - out = subprocess.call(parser.get_command(), timeout=AGENT_AUTH_LAUNCH_TIMEOUT) + subprocess.call(parser.get_command(), timeout=AGENT_AUTH_LAUNCH_TIMEOUT) diff --git a/tests/integration/test_wazuh_db/data/global/global_messages.yaml b/tests/integration/test_wazuh_db/data/global/global_messages.yaml index 9a52de82bf..b86daf0b30 100644 --- a/tests/integration/test_wazuh_db/data/global/global_messages.yaml +++ b/tests/integration/test_wazuh_db/data/global/global_messages.yaml @@ -43,7 +43,7 @@ stage: "global insert-agent success" - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","node_name":"unknown","date_add":1599223378,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' + output: 'ok [{"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","node_name":"unknown","date_add":1599223378,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced","status_code":0}]' stage: "global get-agent-info after insert" - input: 'global find-agent {"name":"TestName1","ip":"0.0.0.1"}' @@ -57,7 +57,7 @@ input: 'global insert-agent {"id":2,"name":"TestName2","date_add":1599223378}' output: "ok" stage: "global insert-agent minimal fields success" - - + - input: 'global get-agent-info 2' output: 'ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' stage: "global get-agent-info after minimal fields insert" From c2426ea42cfd50a79639ad857ffb3b9ebe1459bf Mon Sep 17 00:00:00 2001 From: Kevin Ledesma Date: Thu, 16 Mar 2023 10:56:55 -0300 Subject: [PATCH 03/34] feat(#4022): adapt enrollment tests to new payload --- tests/integration/test_enrollment/conftest.py | 5 +- .../data/wazuh_enrollment_tests.yaml | 266 +++---- .../integration/test_enrollment/enrollment.py | 5 +- .../test_agent_auth_enrollment.py | 6 +- .../test_enrollment/test_agentd_enrollment.py | 4 +- .../data/global/global_messages.yaml | 729 +++++++++--------- 6 files changed, 512 insertions(+), 503 deletions(-) diff --git a/tests/integration/test_enrollment/conftest.py b/tests/integration/test_enrollment/conftest.py index 20faa79801..71624e0e27 100644 --- a/tests/integration/test_enrollment/conftest.py +++ b/tests/integration/test_enrollment/conftest.py @@ -5,7 +5,7 @@ import ssl import socket -from wazuh_testing.tools import WAZUH_PATH, CLIENT_KEYS_PATH +from wazuh_testing.tools import WAZUH_PATH, CLIENT_KEYS_PATH, get_version from wazuh_testing.tools.monitoring import ManInTheMiddle from wazuh_testing.tools.security import CertificateController from wazuh_testing.tools.utils import get_host_name @@ -68,7 +68,8 @@ def configure_socket_listener(request, get_current_test_case): else: response = "".encode() if 'message' in get_current_test_case and 'expected' in get_current_test_case['message']: - expected = get_current_test_case['message']['expected'].format(host_name=get_host_name()).encode() + expected = get_current_test_case['message']['expected'].format(host_name=get_host_name(), + agent_version=get_version()).encode() else: expected = None address_family = 'AF_INET6' if 'ipv6' in get_current_test_case else 'AF_INET' diff --git a/tests/integration/test_enrollment/data/wazuh_enrollment_tests.yaml b/tests/integration/test_enrollment/data/wazuh_enrollment_tests.yaml index 9d66783b8a..8344139121 100644 --- a/tests/integration/test_enrollment/data/wazuh_enrollment_tests.yaml +++ b/tests/integration/test_enrollment/data/wazuh_enrollment_tests.yaml @@ -1,225 +1,228 @@ - - name: "Default Name" - description: "No agent name in auto enrollment configuration" + name: Default Name + description: No agent name in auto enrollment configuration pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - - name: "Valid agent address" - description: "Check a valid agent_address configuration" + name: Valid agent address + description: Check a valid agent_address configuration configuration: - agent_address: "192.168.0.10" + agent_address: 192.168.0.10 pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'192.168.0.10'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}' IP:'192.168.0.10'\n" response: "OSSEC K:'001 {host_name} 192.168.0.10 TopSecret'\n" - - name: "Valid agent address CIDR" - description: "Check a valid agent_address configuration CIDR" + name: Valid agent address CIDR + description: Check a valid agent_address configuration CIDR configuration: - agent_address: "192.168.0.10/24" + agent_address: 192.168.0.10/24 pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'192.168.0.10/24'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}' IP:'192.168.0.10/24'\n" response: "OSSEC K:'001 {host_name} 192.168.0.10/24 TopSecret'\n" - - name: "Invalid Agent address CIDR" - description: "Check an invalid CIDR agent_address in auto enrollment configuration" - skips: "agent-auth" + name: Invalid Agent address CIDR + description: Check an invalid CIDR agent_address in auto enrollment configuration + skips: agent-auth configuration: - agent_address: "192.168.0.10/100" + agent_address: 192.168.0.10/100 expected_error: "ERROR: (4104): Invalid hostname: '192.168.0.10/100'." expected_fail: - os: "win32" + os: win32 reason: "Known Issue: Invalid adress is not checked. https://github.com/wazuh/wazuh/issues/4965" message: response: "OSSEC K:'001 {host_name} 192.168.0.10/24 TopSecret'\n" - - name: "Invalid Agent address CIDR" - description: "Check an invalid CIDR agent_address in auto enrollment configuration" - skips: "wazuh-agentd" + name: Invalid Agent address CIDR + description: Check an invalid CIDR agent_address in auto enrollment configuration + skips: wazuh-agentd configuration: - agent_address: "192.168.0.10/100" + agent_address: 192.168.0.10/100 expected_error: "ERROR: Invalid IP address provided for sender IP." expected_fail: - os: "win32" + os: win32 reason: "Known Issue: Invalid adress is not checked. https://github.com/wazuh/wazuh/issues/4965" message: response: "OSSEC K:'001 {host_name} 192.168.0.10/24 TopSecret'\n" - - name: "Invalid Agent address" - description: "Check an invalid agent_address in auto enrollment configuration" + name: Invalid Agent address + description: Check an invalid agent_address in auto enrollment configuration configuration: - agent_address: "192.168.0.1000" + agent_address: 192.168.0.1000 pre_existent_keys: - "" expected_error: "ERROR: Invalid IP address provided for sender IP." expected_fail: - os: "any" + os: any reason: "Known Issue: Invalid adress is not checked. https://github.com/wazuh/wazuh/issues/4965" message: response: "OSSEC K:'001 {host_name} 192.168.0.10/24 TopSecret'\n" - - name: "Valid manager address" - description: "Check a valid manager_address configuration" + name: Valid manager address + description: Check a valid manager_address configuration skips: - agent-auth configuration: - manager_address: "127.0.0.1" + manager_address: 127.0.0.1 pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - - name: "Groups" - description: "Agent groups in auto enrollment configuration" + name: Groups + description: Agent groups in auto enrollment configuration configuration: - groups: "group_1" + groups: group_1 pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0' G:'group_1'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}' G:'group_1'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - - name: "Multi Groups" - description: "Agent multi groups in auto enrollment configuration" + name: Multi Groups + description: Agent multi groups in auto enrollment configuration configuration: - groups: "group_1,group_2" + groups: group_1,group_2 pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0' G:'group_1,group_2'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}' G:'group_1,group_2'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - - name: "Invalid enabled" - description: "Check an invalid enabled in auto enrollment configuration" + name: Invalid enabled + description: Check an invalid enabled in auto enrollment configuration skips: - agent-auth configuration: - enabled: "nn" + enabled: nn pre_existent_keys: - "" expected_error: "ERROR: Invalid content for tag 'enabled'." - - name: "Valid agent name config" - description: "Check a valid agent_name configuration" + name: Valid agent name config + description: Check a valid agent_name configuration configuration: - agent_name: "test_agent" + agent_name: test_agent pre_existent_keys: - "" message: - expected: "OSSEC A:'test_agent' V:'v4.5.0'\n" + expected: "OSSEC A:'test_agent' V:'{agent_version}'\n" response: "OSSEC K:'001 test_agent any TopSecret'\n" - - name: "Valid agent name config max length" - description: "Check a valid agent_name configuration max length" + name: Valid agent name config max length + description: Check a valid agent_name configuration max length configuration: - agent_name: "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn" + agent_name: nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn pre_existent_keys: - "" message: - expected: "OSSEC A:'nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn' V:'v4.5.0'\n" - response: "OSSEC K:'001 nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn any TopSecret'\n" + expected: "OSSEC A:'nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn\ + nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn' V:'{agent_version}'\n" + response: "OSSEC K:'001 nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn\ + nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn any TopSecret'\n" - - name: "Invalid agent name config" - description: "Check an invalid agent_name configuration" + name: Invalid agent name config + description: Check an invalid agent_name configuration configuration: - agent_name: "test_agent/+bad" + agent_name: test_agent/+bad pre_existent_keys: - "" expected_error: "ERROR: Invalid agent name" - - name: "Invalid agent name config - too short" - description: "Check an invalid agent_name configuration too short" + name: Invalid agent name config - too short + description: Check an invalid agent_name configuration too short configuration: - agent_name: "n" + agent_name: n pre_existent_keys: - "" expected_error: "ERROR: Invalid agent name" - - name: "Invalid agent name config - too long" - description: "Check an invalid agent_name configuration too long" + name: Invalid agent name config - too long + description: Check an invalid agent_name configuration too long configuration: - agent_name: "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn" + agent_name: nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn + nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn pre_existent_keys: - "" expected_error: "ERROR: Invalid agent name" - - name: "Use source IP" - description: "Check that source IP is sent by agent" + name: Use source IP + description: Check that source IP is sent by agent configuration: use_source_ip: "yes" pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'src'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}' IP:'src'\n" response: "OSSEC K:'001 {host_name} 192.168.0.10 TopSecret'\n" - - name: "Incompatible - Use source IP" - description: "Use source IP option while trying to set an IP" + name: Incompatible - Use source IP + description: Use source IP option while trying to set an IP skips: - wazuh-agentd configuration: use_source_ip: "yes" - agent_address: "127.0.0.1" + agent_address: 127.0.0.1 pre_existent_keys: - "" expected_error: "ERROR: Options '-I' and '-i' are uncompatible." - - name: "Incompatible - Use source IP" - description: "Use source IP option while trying to set an IP" + name: Incompatible - Use source IP + description: Use source IP option while trying to set an IP skips: - agent-auth configuration: use_source_ip: "yes" - agent_address: "127.0.0.1" + agent_address: 127.0.0.1 pre_existent_keys: - "" expected_error: "ERROR: Incompatible sender_ip options: Forcing IP while using use_source_ip flag." - - name: "Password from string - Agent-Auth" - description: "Check that configured password is sent on string" + name: Password from string - Agent-Auth + description: Check that configured password is sent on string skips: - wazuh-agentd configuration: - password: "pass123" + password: pass123 pre_existent_keys: - "" message: - expected: "OSSEC PASS: pass123 OSSEC A:'{host_name}' V:'v4.5.0'\n" + expected: "OSSEC PASS: pass123 OSSEC A:'{host_name}' V:'{agent_version}'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - - name: "Password from file - Agent-Auth" - description: "Check that password file is open and read successfully" + name: Password from file - Agent-Auth + description: Check that password file is open and read successfully skips: - wazuh-agentd - password_file_content: "pass_from_file" + password_file_content: pass_from_file pre_existent_keys: - "" message: - expected: "OSSEC PASS: pass_from_file OSSEC A:'{host_name}' V:'v4.5.0'\n" + expected: "OSSEC PASS: pass_from_file OSSEC A:'{host_name}' V:'{agent_version}'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - - name: "Password from file - Agentd" - description: "Check that password file is open and read successfully" + name: Password from file - Agentd + description: Check that password file is open and read successfully skips: - agent-auth configuration: authorization_pass_path: "{PASSWORD_PATH}" - password_file_content: "pass_from_file" + password_file_content: pass_from_file pre_existent_keys: - "" message: - expected: "OSSEC PASS: pass_from_file OSSEC A:'{host_name}' V:'v4.5.0'\n" + expected: "OSSEC PASS: pass_from_file OSSEC A:'{host_name}' V:'{agent_version}'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - - name: "Valid port" - description: "Check a valid port configuration" + name: Valid port + description: Check a valid port configuration skips: - agent-auth configuration: @@ -227,11 +230,11 @@ pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - - name: "Invalid port 65536" - description: "Check an invalid port configuration 65536" + name: Invalid port 65536 + description: Check an invalid port configuration 65536 skips: - agent-auth configuration: @@ -240,8 +243,8 @@ - "" expected_error: "(1205): Invalid port number: '65536'" - - name: "Invalid port 0" - description: "Check an invalid port configuration 0" + name: Invalid port 0 + description: Check an invalid port configuration 0 skips: - agent-auth configuration: @@ -250,8 +253,8 @@ - "" expected_error: "(1205): Invalid port number: '0'" - - name: "Invalid port -1515" - description: "Check an invalid port configuration -1515" + name: Invalid port -1515 + description: Check an invalid port configuration -1515 skips: - agent-auth configuration: @@ -260,107 +263,108 @@ - "" expected_error: "ERROR: (1235): Invalid value for element 'port': -1515." - - name: "Default Name with key hash" - description: "Check the default message when having a key hash" + name: Default Name with key hash + description: Check the default message when having a key hash pre_existent_keys: - - "001 test_name any TopSecret" + - 001 test_name any TopSecret message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - - name: "Valid agent address with key hash" - description: "Check a valid agent_address configuration when having a key hash" + name: Valid agent address with key hash + description: Check a valid agent_address configuration when having a key hash configuration: - agent_address: "192.168.0.10" + agent_address: 192.168.0.10 pre_existent_keys: - - "001 test_name any TopSecret" + - 001 test_name any TopSecret message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'192.168.0.10' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}' IP:'192.168.0.10' \ + K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" response: "OSSEC K:'001 {host_name} 192.168.0.10 TopSecret' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" - - name: "Groups with key hash" - description: "Check a registration command with groups and key hash" + name: Groups with key hash + description: Check a registration command with groups and key hash configuration: - groups: "group_1" + groups: group_1 pre_existent_keys: - - "001 test_name any TopSecret" + - 001 test_name any TopSecret message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0' G:'group_1' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}' G:'group_1' K:'5f7b611efd8882c0b11d87d284158faefafddf21'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - - name: "Valid agent IPv6 address" - description: "Check a valid IPv6 agent_address configuration" + name: Valid agent IPv6 address + description: Check a valid IPv6 agent_address configuration configuration: - agent_address: "02db:4660:46af:e523:d05e:a62e:4ca7:8e58" + agent_address: 02db:4660:46af:e523:d05e:a62e:4ca7:8e58 pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'02DB:4660:46AF:E523:D05E:A62E:4CA7:8E58'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}' IP:'02DB:4660:46AF:E523:D05E:A62E:4CA7:8E58'\n" response: "OSSEC K:'001 {host_name} 02DB:4660:46AF:E523:D05E:A62E:4CA7:8E58 TopSecret'\n" - - name: "Valid compressed agent IPv6 address" - description: "Check a valid compressed IPv6 agent_address configuration" + name: Valid compressed agent IPv6 address + description: Check a valid compressed IPv6 agent_address configuration configuration: - agent_address: "2001:db8:0:b::1A" + agent_address: 2001:db8:0:b::1A pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0' IP:'2001:0DB8:0000:000B:0000:0000:0000:001A'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}' IP:'2001:0DB8:0000:000B:0000:0000:0000:001A'\n" response: "OSSEC K:'001 {host_name} 2001:0DB8:0000:000B:0000:0000:0000:001A TopSecret'\n" - - name: "Invalid Agent IPv6 address double colon" - description: "Check an invalid agent_address with double colon in auto enrollment configuration" + name: Invalid Agent IPv6 address double colon + description: Check an invalid agent_address with double colon in auto enrollment configuration configuration: - agent_address: "56FE::2159:5BBC::6594" + agent_address: 56FE::2159:5BBC::6594 pre_existent_keys: - "" expected_error: - agent-auth: "ERROR: Invalid IP address provided for sender IP." - agent-enrollment: "ERROR: (4104): Invalid hostname: '56FE::2159:5BBC::6594'." + agent-auth: "ERROR: Invalid IP address provided for sender IP." + agent-enrollment: "ERROR: (4104): Invalid hostname: '56FE::2159:5BBC::6594'." expected_fail: - os: "win32" + os: win32 reason: "Known Issue: Invalid address is not checked. https://github.com/wazuh/wazuh/issues/4965" message: response: "OSSEC K:'001 {host_name} 56FE::2159:5BBC::6594 TopSecret'\n" - - name: "Valid manager IPv6 address" - description: "Check a valid manager_address configuration" - ipv6: 'manager' + name: Valid manager IPv6 address + description: Check a valid manager_address configuration + ipv6: manager configuration: - manager_address: "::1" + manager_address: ::1 pre_existent_keys: - "" message: - expected: "OSSEC A:'{host_name}' V:'v4.5.0'\n" + expected: "OSSEC A:'{host_name}' V:'{agent_version}'\n" response: "OSSEC K:'001 {host_name} any TopSecret'\n" - - name: "Invalid long agent IPv6 address" - description: "Check an invalid agent_address in auto enrollment configuration" + name: Invalid long agent IPv6 address + description: Check an invalid agent_address in auto enrollment configuration configuration: - agent_address: "11AA:11AA:11AA:11AA:11AA:11AA:11AA:11AA:11AA" + agent_address: 11AA:11AA:11AA:11AA:11AA:11AA:11AA:11AA:11AA pre_existent_keys: - "" expected_error: agent-auth: "ERROR: Invalid IP address provided for sender IP." agent-enrollment: "ERROR: (4104): Invalid hostname: '11AA:11AA:11AA:11AA:11AA:11AA:11AA:11AA:11AA'." expected_fail: - os: "win32" + os: win32 reason: "Known Issue: Invalid address is not checked. https://github.com/wazuh/wazuh/issues/4965" message: response: "OSSEC K:'001 {host_name} 11AA:11AA:11AA:11AA:11AA:11AA:11AA:11AA:11AA TopSecret'\n" - - name: "Invalid Agent IPv6 address with words" - description: "Check an invalid agent_address in auto enrollment configuration" + name: Invalid Agent IPv6 address with words + description: Check an invalid agent_address in auto enrollment configuration configuration: - agent_address: "02db:4660:46af:invalid:d05e:a62e:4ca7:8e58" + agent_address: 02db:4660:46af:invalid:d05e:a62e:4ca7:8e58 pre_existent_keys: - "" expected_error: - agent-auth: "ERROR: Invalid IP address provided for sender IP." - agent-enrollment: "ERROR: (4104): Invalid hostname: '02db:4660:46af:invalid:d05e:a62e:4ca7:8e58'." + agent-auth: "ERROR: Invalid IP address provided for sender IP." + agent-enrollment: "ERROR: (4104): Invalid hostname: '02db:4660:46af:invalid:d05e:a62e:4ca7:8e58'." expected_fail: - os: "win32" + os: win32 reason: "Known Issue: Invalid address is not checked. https://github.com/wazuh/wazuh/issues/4965" message: response: "OSSEC K:'001 {host_name} 02db:4660:46af:invalid:d05e:a62e:4ca7:8e58 TopSecret'\n" diff --git a/tests/integration/test_enrollment/enrollment.py b/tests/integration/test_enrollment/enrollment.py index 24eda59dc0..d40f4bdadd 100644 --- a/tests/integration/test_enrollment/enrollment.py +++ b/tests/integration/test_enrollment/enrollment.py @@ -26,8 +26,9 @@ def launch_agent_auth(configuration): configuration (dict): Dictionary with the agent-auth configuration. """ if configuration.get('manager_address'): - parser = AgentAuthParser(server_address=configuration.get('manager_address'), BINARY_PATH=AGENT_AUTH_BINARY_PATH, - sudo=True if platform.system() == 'Linux' else False) + parser = AgentAuthParser(server_address=configuration.get('manager_address'), + BINARY_PATH=AGENT_AUTH_BINARY_PATH, + sudo=True if platform.system() == 'Linux' else False) else: parser = AgentAuthParser(server_address=MANAGER_ADDRESS, BINARY_PATH=AGENT_AUTH_BINARY_PATH, sudo=True if platform.system() == 'Linux' else False) diff --git a/tests/integration/test_enrollment/test_agent_auth_enrollment.py b/tests/integration/test_enrollment/test_agent_auth_enrollment.py index 9397c031c3..141e732a44 100644 --- a/tests/integration/test_enrollment/test_agent_auth_enrollment.py +++ b/tests/integration/test_enrollment/test_agent_auth_enrollment.py @@ -42,6 +42,7 @@ import os import sys +from wazuh_testing.tools import get_version from wazuh_testing.tools.configuration import load_wazuh_configurations from wazuh_testing.tools.services import control_service from wazuh_testing.tools.file import read_yaml @@ -91,7 +92,7 @@ def test_agent_auth_enrollment(configure_environment, shutdown_agentd, get_curre error log. Agent-auth will be executed using the different parameters and with different keys and password files scenarios as described in the test cases." - wazuh_min_version: 4.2.0 + wazuh_min_version: 4.5.0 tier: 0 @@ -169,7 +170,8 @@ def test_agent_auth_enrollment(configure_environment, shutdown_agentd, get_curre raise error else: - test_expected = get_current_test_case['message']['expected'].format(host_name=get_host_name()).encode() + test_expected = get_current_test_case['message']['expected'].format(host_name=get_host_name(), + agent_version=get_version()).encode() test_response = get_current_test_case['message']['response'].format(host_name=get_host_name()).encode() # Monitor MITM queue socket_monitor = QueueMonitor(request.module.socket_listener.queue) diff --git a/tests/integration/test_enrollment/test_agentd_enrollment.py b/tests/integration/test_enrollment/test_agentd_enrollment.py index f85762c2c2..6bbe79a324 100644 --- a/tests/integration/test_enrollment/test_agentd_enrollment.py +++ b/tests/integration/test_enrollment/test_agentd_enrollment.py @@ -44,6 +44,7 @@ import sys import subprocess +from wazuh_testing.tools import get_version from wazuh_testing.tools.services import control_service from wazuh_testing.tools.file import read_yaml from wazuh_testing.tools.monitoring import QueueMonitor, make_callback @@ -178,7 +179,8 @@ def test_agentd_enrollment(configure_environment, override_wazuh_conf, get_curre raise error else: - test_expected = get_current_test_case['message']['expected'].format(host_name=get_host_name()).encode() + test_expected = get_current_test_case['message']['expected'].format(host_name=get_host_name(), + agent_version=get_version()).encode() test_response = get_current_test_case['message']['response'].format(host_name=get_host_name()).encode() # Monitor MITM queue diff --git a/tests/integration/test_wazuh_db/data/global/global_messages.yaml b/tests/integration/test_wazuh_db/data/global/global_messages.yaml index b86daf0b30..86809e31f9 100644 --- a/tests/integration/test_wazuh_db/data/global/global_messages.yaml +++ b/tests/integration/test_wazuh_db/data/global/global_messages.yaml @@ -1,389 +1,388 @@ ---- - - name: "Insert commands" - description: "Check success use cases for insert commands on global DB" + name: Insert commands + description: Check success use cases for insert commands on global DB test_case: - - - input: 'global delete-group TestGroup1' - output: "ok" - stage: "global delete-group previous insert" - - - input: 'global find-group TestGroup1' - output: "ok []" - stage: "global find-group previous insert" - - - input: 'global insert-agent-group TestGroup1' - output: 'ok' - stage: "global insert-agent-group success" - - - input: 'global find-group default' - output: 'ok [{"id":*}]' - stage: "global find-group after insert" - use_regex: "yes" - - - input: 'global find-group TestGroup1' - output: 'ok [{"id":*}]' - stage: "global find-group after insert" - use_regex: "yes" - - - input: 'global select-groups' - output: 'ok [{"name":"default"},{"name":"TestGroup1"}]' - stage: "global select-groups success" - - - input: 'global delete-agent 1' - output: "ok" - stage: "global delete-agent previous insert" - - - input: 'global get-agent-info 1' - output: 'ok []' - stage: "global get-agent-info previous insert" - - - input: 'global insert-agent {"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","group":"TestGroup1","date_add":1599223378}' - output: "ok" - stage: "global insert-agent success" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","node_name":"unknown","date_add":1599223378,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced","status_code":0}]' - stage: "global get-agent-info after insert" - - - input: 'global find-agent {"name":"TestName1","ip":"0.0.0.1"}' - output: 'ok [{"id":1}]' - stage: "global find-agent success" - - - input: 'global delete-agent 2' - output: "ok" - stage: "global delete-agent previous insert" - - - input: 'global insert-agent {"id":2,"name":"TestName2","date_add":1599223378}' - output: "ok" - stage: "global insert-agent minimal fields success" - - - input: 'global get-agent-info 2' - output: 'ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global get-agent-info after minimal fields insert" - - - input: 'global delete-agent 2' - output: "ok" - stage: "global delete-agent after insert" - - - input: 'global insert-agent {"id":2,"name":"TestName2","date_add":1599223378}' - output: "ok" - stage: "global insert-agent agent 2 again after delete" + - + input: global delete-group TestGroup1 + output: ok + stage: global delete-group previous insert + - + input: global find-group TestGroup1 + output: ok [] + stage: global find-group previous insert + - + input: global insert-agent-group TestGroup1 + output: ok + stage: global insert-agent-group success + - + input: global find-group default + output: ok [{"id":*}] + stage: global find-group after insert + use_regex: "yes" + - + input: global find-group TestGroup1 + output: ok [{"id":*}] + stage: global find-group after insert + use_regex: "yes" + - + input: global select-groups + output: ok [{"name":"default"},{"name":"TestGroup1"}] + stage: global select-groups success + - + input: global delete-agent 1 + output: ok + stage: global delete-agent previous insert + - + input: global get-agent-info 1 + output: ok [] + stage: global get-agent-info previous insert + - + input: global insert-agent {"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1", + "internal_key":"TopSecret","group":"TestGroup1","date_add":1599223378} + output: ok + stage: global insert-agent success + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","node_name":"unknown","date_add":1599223378,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced","status_code":0}]' + stage: global get-agent-info after insert + - + input: global find-agent {"name":"TestName1","ip":"0.0.0.1"} + output: ok [{"id":1}]' + stage: global find-agent success + - + input: global delete-agent 2 + output: ok + stage: global delete-agent previous insert + - + input: global insert-agent {"id":2,"name":"TestName2","date_add":1599223378} + output: ok + stage: global insert-agent minimal fields success + - + input: global get-agent-info 2 + output: ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' + stage: global get-agent-info after minimal fields insert + - + input: global delete-agent 2 + output: ok + stage: global delete-agent after insert + - + input: global insert-agent {"id":2,"name":"TestName2","date_add":1599223378} + output: ok + stage: global insert-agent agent 2 again after delete - - name: "Update commands" - description: "Check success use cases for update commands on global DB" + name: Update commands + description: Check success use cases for update commands on global DB test_case: - - - input: 'global update-agent-name {"id":1,"name":"TestName2"}' - output: "ok" - stage: "global update-agent-name success" - - - input: 'global update-agent-data {"id":1,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","agent_ip":"0.0.0.1","sync_status":"syncreq","group_config_status":"not synced","connection_status":"never_connected","labels":"TestKey1:TestLabel1"}' - output: "ok" - stage: "global update-agent-data success" - - - input: 'global update-connection-status {"id":1,"connection_status":"pending","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status pending success" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"pending","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global get-agent-info success after updates" - use_regex: "yes" - - - input: 'global update-connection-status {"id":1,"connection_status":"active","sync_status":"synced"}' - output: "ok" - stage: "global update-connection-status active success" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global get-agent-info success after updates" - use_regex: "yes" - - - input: 'global update-connection-status {"id":1,"connection_status":"disconnected","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status disconnected success" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' - stage: "global get-agent-info success after updates" - use_regex: "yes" - - - input: 'global update-connection-status {"id":1,"connection_status":"dummy_status","sync_status":"synced"}' - output: "err Cannot execute Global database query; CHECK constraint failed: connection_status IN ('pending', 'never_connected', 'active', 'disconnected')" - stage: "global update-connection-status dummy_status error" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*}]' - stage: "global get-agent-info success after updates" - use_regex: "yes" - - - input: 'global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"}' - output: "ok" - stage: "global update-keepalive success" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global get-agent-info success after updates" - use_regex: "yes" + - + input: global update-agent-name {"id":1,"name":"TestName2"} + output: ok + stage: global update-agent-name success + - + input: global update-agent-data {"id":1,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","agent_ip":"0.0.0.1","sync_status":"syncreq","group_config_status":"not synced","connection_status":"never_connected","labels":"TestKey1:TestLabel1"} + output: ok + stage: global update-agent-data success + - + input: global update-connection-status {"id":1,"connection_status":"pending","sync_status":"syncreq"} + output: ok + stage: global update-connection-status pending success + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"pending","disconnection_time":0,"group_config_status":"not synced"}]' + stage: global get-agent-info success after updates + use_regex: "yes" + - + input: global update-connection-status {"id":1,"connection_status":"active","sync_status":"synced"} + output: ok + stage: global update-connection-status active success + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' + stage: global get-agent-info success after updates + use_regex: "yes" + - + input: global update-connection-status {"id":1,"connection_status":"disconnected","sync_status":"syncreq"} + output: ok + stage: global update-connection-status disconnected success + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' + stage: global get-agent-info success after updates + use_regex: "yes" + - + input: global update-connection-status {"id":1,"connection_status":"dummy_status","sync_status":"synced"} + output: "err Cannot execute Global database query; CHECK constraint failed: connection_status IN ('pending', 'never_connected', 'active', 'disconnected')" + stage: global update-connection-status dummy_status error + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*}]' + stage: global get-agent-info success after updates + use_regex: "yes" + - + input: global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"} + output: ok + stage: global update-keepalive success + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' + stage: global get-agent-info success after updates + use_regex: "yes" - - name: "Labels commands" - description: "Check success use cases for labels table commands on global DB" + name: Labels commands + description: Check success use cases for labels table commands on global DB test_case: - - - input: 'global get-labels 1' - output: 'ok [{"id":1,"key":"TestKey1","value":"TestLabel1"}]' - stage: "global get-labels success" + - + input: global get-labels 1 + output: ok [{"id":1,"key":"TestKey1","value":"TestLabel1"}]' + stage: global get-labels success - - name: "Select commands" - description: "Check success use cases for select commands on global DB" + name: Select commands + description: Check success use cases for select commands on global DB test_case: - - - input: 'global select-agent-name 1' - output: 'ok [{"name":"TestName2"}]' - stage: "global select-agent-name success" - - - input: 'global select-agent-group 1' - output: 'ok [{"group":"TestGroup1"}]' - stage: "global select-agent-group success" - - - input: 'global select-groups' - output: 'ok [{"name":"default"},{"name":"TestGroup1"}]' - stage: "global select-groups success" + - + input: global select-agent-name 1 + output: ok [{"name":"TestName2"}]' + stage: global select-agent-name success + - + input: global select-agent-group 1 + output: ok [{"group":"TestGroup1"}]' + stage: global select-agent-group success + - + input: global select-groups + output: ok [{"name":"default"},{"name":"TestGroup1"}]' + stage: global select-groups success - - name: "get-all-agents command" - description: "Check success use cases for get-all-agents command on global DB. Chunks command" + name: get-all-agents command + description: Check success use cases for get-all-agents command on global DB. Chunks command test_case: - - - input: 'global get-all-agents last_id -1' - output: 'ok [{"id":0},{"id":1},{"id":2}]' - stage: "global get-all-agents success" + - + input: global get-all-agents last_id -1 + output: ok [{"id":0},{"id":1},{"id":2}]' + stage: global get-all-agents success - - name: "sync-agent-info-get command" - description: "Check success use cases for sync-agent-info-get command on global DB. Chunks command" + name: sync-agent-info-get command + description: Check success use cases for sync-agent-info-get command on global DB. Chunks command test_case: - - - input: 'global sync-agent-info-get last_id 0' - output: 'ok []' - stage: "global sync-agent-info-get success" - use_regex: 'yes' - - - input: 'global sync-agent-info-get last_id 0' - output: 'ok []' - stage: "global sync-agent-info-get after first get success" - - - input: 'global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"}' - output: "ok" - stage: "global update-keepalive success" + - + input: global sync-agent-info-get last_id 0 + output: ok [] + stage: global sync-agent-info-get success + use_regex: 'yes' + - + input: global sync-agent-info-get last_id 0 + output: ok [] + stage: global sync-agent-info-get after first get success + - + input: global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"} + output: ok + stage: global update-keepalive success - - name: "sync-agent-info-set command" - description: "Check success use cases for sync-agent-info-get command on global DB." + name: sync-agent-info-set command + description: Check success use cases for sync-agent-info-get command on global DB. test_case: - - - input: 'global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","last_keepalive":200,"group_config_status":"not synced"}]' - output: 'ok' - stage: "global sync-agent-info-set non-existent agent" - - - input: 'global get-agent-info 3' - output: 'ok []' - stage: "global get-agent-info success after non-existent sync-agent-info-set" - - - input: 'global delete-agent 3' - output: "ok" - stage: "global delete-agent previous insert" - - - input: 'global insert-agent {"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","date_add":1599223378}' - output: "ok" - stage: "global insert-agent success" - - - input: 'global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","last_keepalive":200,"connection_status":"never_connected","disconnection_time":0, "group_config_status":"not synced"}]' - output: 'ok' - stage: "global sync-agent-info-set success" - - - input: 'global get-agent-info 3' - output: 'ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":200,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global get-agent-info success after sync-agent-info-set success" + - + input: global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","last_keepalive":200,"group_config_status":"not synced"}] + output: ok' + stage: global sync-agent-info-set non-existent agent + - + input: global get-agent-info 3 + output: ok [] + stage: global get-agent-info success after non-existent sync-agent-info-set + - + input: global delete-agent 3 + output: ok + stage: global delete-agent previous insert + - + input: global insert-agent {"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","date_add":1599223378} + output: ok + stage: global insert-agent success + - + input: global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","last_keepalive":200,"connection_status":"never_connected","disconnection_time":0, "group_config_status":"not synced"}] + output: ok' + stage: global sync-agent-info-set success + - + input: global get-agent-info 3 + output: ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":200,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' + stage: global get-agent-info success after sync-agent-info-set success - - name: "Reset connection status" - description: "Check success use cases for reset connection status command." + name: Reset connection status + description: Check success use cases for reset connection status command. test_case: - - - input: 'global update-connection-status {"id":1,"connection_status":"pending","sync_status":"synced"}' - output: "ok" - stage: "global update-connection-status pending success" - - - input: 'global update-connection-status {"id":3,"connection_status":"active","sync_status":"synced"}' - output: "ok" - stage: "global update-connection-status active success" - - - input: 'global sql SELECT id,sync_status FROM agent' - output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"synced"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}]' - stage: "global checking sync_status before reset-agents-connection" - - - input: 'global reset-agents-connection syncreq' - output: 'ok' - stage: "global reset-agents-connection success" - - - input: 'global sql SELECT id,sync_status FROM agent' - output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"syncreq"}]' - stage: "global checking sync_status after reset-agents-connection" - - - input: 'global get-agent-info 0' - output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' - stage: "global manager get-agent-info success post reset connection status" - use_regex: "yes" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' - stage: "global agent get-agent-info success post reset connection status" - use_regex: "yes" - - - input: 'global get-agent-info 2' - output: 'ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global agent get-agent-info success post reset connection status" - use_regex: "yes" - - - input: 'global get-agent-info 3' - output: 'ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' - stage: "global agent get-agent-info success post reset connection status" - use_regex: "yes" + - + input: global update-connection-status {"id":1,"connection_status":"pending","sync_status":"synced"} + output: ok + stage: global update-connection-status pending success + - + input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"synced"} + output: ok + stage: global update-connection-status active success + - + input: global sql SELECT id,sync_status FROM agent + output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"synced"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}]' + stage: global checking sync_status before reset-agents-connection + - + input: global reset-agents-connection syncreq + output: ok' + stage: global reset-agents-connection success + - + input: global sql SELECT id,sync_status FROM agent + output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"syncreq"}]' + stage: global checking sync_status after reset-agents-connection + - + input: global get-agent-info 0 + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' + stage: global manager get-agent-info success post reset connection status + use_regex: "yes" + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' + stage: global agent get-agent-info success post reset connection status + use_regex: "yes" + - + input: global get-agent-info 2 + output: ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' + stage: global agent get-agent-info success post reset connection status + use_regex: "yes" + - + input: global get-agent-info 3 + output: ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' + stage: global agent get-agent-info success post reset connection status + use_regex: "yes" - - name: "get-agents-by-connection-status command" - description: "Check success use cases for get-agents-by-connection-status command on global DB." + name: get-agents-by-connection-status command + description: Check success use cases for get-agents-by-connection-status command on global DB. test_case: - - - input: 'global update-connection-status {"id":1,"connection_status":"never_connected","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status never_connected" - - - input: 'global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status pending" - - - input: 'global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status active" - - - input: 'global get-agents-by-connection-status 0 never_connected' - output: 'ok [{"id":1}]' - stage: "global get-agents-by-connection-status never_connected success" - - - input: 'global get-agents-by-connection-status 0 pending' - output: 'ok [{"id":2}]' - stage: "global get-agents-by-connection-status pending success" - - - input: 'global get-agents-by-connection-status 0 active' - output: 'ok [{"id":3}]' - stage: "global get-agents-by-connection-status active success" - - - input: 'global sql SELECT id,sync_status FROM agent' - output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"syncreq"},{"id":3,"sync_status":"syncreq"}]' - stage: "global checking sync_status before reset-agents-connection" - - - input: 'global reset-agents-connection synced' - output: 'ok' - stage: "global reset-agents-connection" - - - input: 'global sql SELECT id,sync_status FROM agent' - output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}]' - stage: "global checking sync_status after reset-agents-connection" - - - input: 'global get-agents-by-connection-status 0 disconnected' - output: 'ok [{"id":2},{"id":3}]' - stage: "global get-agents-by-connection-status disconnected success" + - + input: global update-connection-status {"id":1,"connection_status":"never_connected","sync_status":"syncreq"} + output: ok + stage: global update-connection-status never_connected + - + input: global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"} + output: ok + stage: global update-connection-status pending + - + input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"} + output: ok + stage: global update-connection-status active + - + input: global get-agents-by-connection-status 0 never_connected + output: ok [{"id":1}]' + stage: global get-agents-by-connection-status never_connected success + - + input: global get-agents-by-connection-status 0 pending + output: ok [{"id":2}]' + stage: global get-agents-by-connection-status pending success + - + input: global get-agents-by-connection-status 0 active + output: ok [{"id":3}]' + stage: global get-agents-by-connection-status active success + - + input: global sql SELECT id,sync_status FROM agent + output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"syncreq"},{"id":3,"sync_status":"syncreq"}]' + stage: global checking sync_status before reset-agents-connection + - + input: global reset-agents-connection synced + output: ok' + stage: global reset-agents-connection + - + input: global sql SELECT id,sync_status FROM agent + output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}]' + stage: global checking sync_status after reset-agents-connection + - + input: global get-agents-by-connection-status 0 disconnected + output: ok [{"id":2},{"id":3}]' + stage: global get-agents-by-connection-status disconnected success - - name: "disconnect-agents command" - description: "Check the right behavior of disconnect-agents command on global DB." + name: disconnect-agents command + description: Check the right behavior of disconnect-agents command on global DB. test_case: - - - input: 'global sql UPDATE agent SET last_keepalive = 100 WHERE id = 1;' - output: "ok []" - stage: "global updating agent's 1 keepalive to 100" - - - input: 'global update-connection-status {"id":1,"connection_status":"active","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status as active for agent 1 success" - - - input: 'global sql UPDATE agent SET last_keepalive = 150 WHERE id = 2;' - output: "ok []" - stage: "global updating agent's 2 keepalive to 150" - - - input: 'global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status as pending for agent 2 success" - - - input: 'global sql UPDATE agent SET last_keepalive = 200 WHERE id = 3;' - output: "ok []" - stage: "global updating agent's 3 keepalive to 200" - - - input: 'global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status as active for agent 3 success" - - - input: 'global get-agents-by-connection-status 0 disconnected' - output: 'ok []' - stage: "global get-agents-by-connection-status disconnected before disconnecting agents success" - - - input: 'global sql UPDATE agent SET sync_status = "synced" WHERE id =1' - output: 'ok []' - stage: "global setting sync_status before disconnecting-agents command" - - - input: 'global disconnect-agents 0 175 syncreq' - output: 'ok [{"id":1},{"id":2}]' - stage: "global disconnect-agents success" - - - input: 'global sql SELECT id,sync_status FROM agent WHERE id =1' - output: 'ok [{"id":1,"sync_status":"syncreq"}]' - stage: "global testing sync_status after disconnecting-agents command" - - - input: 'global get-agents-by-connection-status 0 disconnected' - output: 'ok [{"id":1},{"id":2}]' - stage: "global get-agents-by-connection-status disconnected after disconnecting agents success" + - + input: global sql UPDATE agent SET last_keepalive = 100 WHERE id = 1; + output: ok [] + stage: global updating agent's 1 keepalive to 100 + - + input: global update-connection-status {"id":1,"connection_status":"active","sync_status":"syncreq"} + output: ok + stage: global update-connection-status as active for agent 1 success + - + input: global sql UPDATE agent SET last_keepalive = 150 WHERE id = 2; + output: ok [] + stage: global updating agent's 2 keepalive to 150 + - + input: global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"} + output: ok + stage: global update-connection-status as pending for agent 2 success + - + input: global sql UPDATE agent SET last_keepalive = 200 WHERE id = 3; + output: ok [] + stage: global updating agent's 3 keepalive to 200 + - + input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"} + output: ok + stage: global update-connection-status as active for agent 3 success + - + input: global get-agents-by-connection-status 0 disconnected + output: ok [] + stage: global get-agents-by-connection-status disconnected before disconnecting agents success + - + input: global sql UPDATE agent SET sync_status = "synced" WHERE id =1 + output: ok [] + stage: global setting sync_status before disconnecting-agents command + - + input: global disconnect-agents 0 175 syncreq + output: ok [{"id":1},{"id":2}]' + stage: global disconnect-agents success + - + input: global sql SELECT id,sync_status FROM agent WHERE id =1 + output: ok [{"id":1,"sync_status":"syncreq"}]' + stage: global testing sync_status after disconnecting-agents command + - + input: global get-agents-by-connection-status 0 disconnected + output: ok [{"id":1},{"id":2}]' + stage: global get-agents-by-connection-status disconnected after disconnecting agents success - - name: "Delete commands" - description: "Check success use cases for delete commands on global DB." + name: Delete commands + description: Check success use cases for delete commands on global DB. test_case: - - - input: 'global delete-group TestGroup1' - output: "ok" - stage: "global delete-group after insert" - - - input: 'global delete-agent 1' - output: "ok" - stage: "global delete-agent after insert" - - - input: 'global delete-agent 2' - output: "ok" - stage: "global delete-agent after insert" - - - input: 'global delete-agent 3' - output: "ok" - stage: "global delete-agent after insert" + - + input: global delete-group TestGroup1 + output: ok + stage: global delete-group after insert + - + input: global delete-agent 1 + output: ok + stage: global delete-agent after insert + - + input: global delete-agent 2 + output: ok + stage: global delete-agent after insert + - + input: global delete-agent 3 + output: ok + stage: global delete-agent after insert - - name: "Manager keepalive" - description: "Check success use cases for manager keepalive." + name: Manager keepalive + description: Check success use cases for manager keepalive. test_case: - - - input: 'global get-agent-info 0' - output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' - stage: "global manager get-agent-info success pre update" - use_regex: "yes" - - - input: 'global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","group_config_status":"not synced","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","agent_ip":"127.0.0.1","sync_status":"synced","connection_status":"active","disconnection_time":0}' - output: "ok" - stage: "global manager update-agent-data success" - - - input: 'global get-agent-info 0' - output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global manager get-agent-info success post update with IP" - use_regex: "yes" - - - input: 'global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","sync_status":"synced","connection_status":"active","group_config_status":"synced"}' - output: "ok" - stage: "global manager update-agent-data success" - - - input: 'global get-agent-info 0' - output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' - stage: "global manager get-agent-info success post update without IP" - use_regex: "yes" - \ No newline at end of file + - + input: global get-agent-info 0 + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' + stage: global manager get-agent-info success pre update + use_regex: "yes" + - + input: global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","group_config_status":"not synced","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","agent_ip":"127.0.0.1","sync_status":"synced","connection_status":"active","disconnection_time":0} + output: ok + stage: global manager update-agent-data success + - + input: global get-agent-info 0 + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' + stage: global manager get-agent-info success post update with IP + use_regex: "yes" + - + input: global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","sync_status":"synced","connection_status":"active","group_config_status":"synced"} + output: ok + stage: global manager update-agent-data success + - + input: global get-agent-info 0 + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' + stage: global manager get-agent-info success post update without IP + use_regex: "yes" From 6656ad4f97743e5cd641614116602fc520461752 Mon Sep 17 00:00:00 2001 From: Kevin Ledesma Date: Thu, 16 Mar 2023 11:05:20 -0300 Subject: [PATCH 04/34] fix(#4022): fix wazuh_db global messages yaml --- .../data/global/global_messages.yaml | 727 +++++++++--------- 1 file changed, 363 insertions(+), 364 deletions(-) diff --git a/tests/integration/test_wazuh_db/data/global/global_messages.yaml b/tests/integration/test_wazuh_db/data/global/global_messages.yaml index 86809e31f9..8db641419b 100644 --- a/tests/integration/test_wazuh_db/data/global/global_messages.yaml +++ b/tests/integration/test_wazuh_db/data/global/global_messages.yaml @@ -1,388 +1,387 @@ - - name: Insert commands - description: Check success use cases for insert commands on global DB + name: "Insert commands" + description: "Check success use cases for insert commands on global DB" test_case: - - - input: global delete-group TestGroup1 - output: ok - stage: global delete-group previous insert - - - input: global find-group TestGroup1 - output: ok [] - stage: global find-group previous insert - - - input: global insert-agent-group TestGroup1 - output: ok - stage: global insert-agent-group success - - - input: global find-group default - output: ok [{"id":*}] - stage: global find-group after insert - use_regex: "yes" - - - input: global find-group TestGroup1 - output: ok [{"id":*}] - stage: global find-group after insert - use_regex: "yes" - - - input: global select-groups - output: ok [{"name":"default"},{"name":"TestGroup1"}] - stage: global select-groups success - - - input: global delete-agent 1 - output: ok - stage: global delete-agent previous insert - - - input: global get-agent-info 1 - output: ok [] - stage: global get-agent-info previous insert - - - input: global insert-agent {"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1", - "internal_key":"TopSecret","group":"TestGroup1","date_add":1599223378} - output: ok - stage: global insert-agent success - - - input: global get-agent-info 1 - output: ok [{"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","node_name":"unknown","date_add":1599223378,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced","status_code":0}]' - stage: global get-agent-info after insert - - - input: global find-agent {"name":"TestName1","ip":"0.0.0.1"} - output: ok [{"id":1}]' - stage: global find-agent success - - - input: global delete-agent 2 - output: ok - stage: global delete-agent previous insert - - - input: global insert-agent {"id":2,"name":"TestName2","date_add":1599223378} - output: ok - stage: global insert-agent minimal fields success - - - input: global get-agent-info 2 - output: ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' - stage: global get-agent-info after minimal fields insert - - - input: global delete-agent 2 - output: ok - stage: global delete-agent after insert - - - input: global insert-agent {"id":2,"name":"TestName2","date_add":1599223378} - output: ok - stage: global insert-agent agent 2 again after delete + - + input: 'global delete-group TestGroup1' + output: "ok" + stage: "global delete-group previous insert" + - + input: 'global find-group TestGroup1' + output: "ok []" + stage: "global find-group previous insert" + - + input: 'global insert-agent-group TestGroup1' + output: 'ok' + stage: "global insert-agent-group success" + - + input: 'global find-group default' + output: 'ok [{"id":*}]' + stage: "global find-group after insert" + use_regex: "yes" + - + input: 'global find-group TestGroup1' + output: 'ok [{"id":*}]' + stage: "global find-group after insert" + use_regex: "yes" + - + input: 'global select-groups' + output: 'ok [{"name":"default"},{"name":"TestGroup1"}]' + stage: "global select-groups success" + - + input: 'global delete-agent 1' + output: "ok" + stage: "global delete-agent previous insert" + - + input: 'global get-agent-info 1' + output: 'ok []' + stage: "global get-agent-info previous insert" + - + input: 'global insert-agent {"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","group":"TestGroup1","date_add":1599223378}' + output: "ok" + stage: "global insert-agent success" + - + input: 'global get-agent-info 1' + output: 'ok [{"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","node_name":"unknown","date_add":1599223378,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced","status_code":0}]' + stage: "global get-agent-info after insert" + - + input: 'global find-agent {"name":"TestName1","ip":"0.0.0.1"}' + output: 'ok [{"id":1}]' + stage: "global find-agent success" + - + input: 'global delete-agent 2' + output: "ok" + stage: "global delete-agent previous insert" + - + input: 'global insert-agent {"id":2,"name":"TestName2","date_add":1599223378}' + output: "ok" + stage: "global insert-agent minimal fields success" + - + input: 'global get-agent-info 2' + output: 'ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' + stage: "global get-agent-info after minimal fields insert" + - + input: 'global delete-agent 2' + output: "ok" + stage: "global delete-agent after insert" + - + input: 'global insert-agent {"id":2,"name":"TestName2","date_add":1599223378}' + output: "ok" + stage: "global insert-agent agent 2 again after delete" - - name: Update commands - description: Check success use cases for update commands on global DB + name: "Update commands" + description: "Check success use cases for update commands on global DB" test_case: - - - input: global update-agent-name {"id":1,"name":"TestName2"} - output: ok - stage: global update-agent-name success - - - input: global update-agent-data {"id":1,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","agent_ip":"0.0.0.1","sync_status":"syncreq","group_config_status":"not synced","connection_status":"never_connected","labels":"TestKey1:TestLabel1"} - output: ok - stage: global update-agent-data success - - - input: global update-connection-status {"id":1,"connection_status":"pending","sync_status":"syncreq"} - output: ok - stage: global update-connection-status pending success - - - input: global get-agent-info 1 - output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"pending","disconnection_time":0,"group_config_status":"not synced"}]' - stage: global get-agent-info success after updates - use_regex: "yes" - - - input: global update-connection-status {"id":1,"connection_status":"active","sync_status":"synced"} - output: ok - stage: global update-connection-status active success - - - input: global get-agent-info 1 - output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' - stage: global get-agent-info success after updates - use_regex: "yes" - - - input: global update-connection-status {"id":1,"connection_status":"disconnected","sync_status":"syncreq"} - output: ok - stage: global update-connection-status disconnected success - - - input: global get-agent-info 1 - output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' - stage: global get-agent-info success after updates - use_regex: "yes" - - - input: global update-connection-status {"id":1,"connection_status":"dummy_status","sync_status":"synced"} - output: "err Cannot execute Global database query; CHECK constraint failed: connection_status IN ('pending', 'never_connected', 'active', 'disconnected')" - stage: global update-connection-status dummy_status error - - - input: global get-agent-info 1 - output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*}]' - stage: global get-agent-info success after updates - use_regex: "yes" - - - input: global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"} - output: ok - stage: global update-keepalive success - - - input: global get-agent-info 1 - output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' - stage: global get-agent-info success after updates - use_regex: "yes" + - + input: 'global update-agent-name {"id":1,"name":"TestName2"}' + output: "ok" + stage: "global update-agent-name success" + - + input: 'global update-agent-data {"id":1,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","agent_ip":"0.0.0.1","sync_status":"syncreq","group_config_status":"not synced","connection_status":"never_connected","labels":"TestKey1:TestLabel1"}' + output: "ok" + stage: "global update-agent-data success" + - + input: 'global update-connection-status {"id":1,"connection_status":"pending","sync_status":"syncreq"}' + output: "ok" + stage: "global update-connection-status pending success" + - + input: 'global get-agent-info 1' + output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"pending","disconnection_time":0,"group_config_status":"not synced"}]' + stage: "global get-agent-info success after updates" + use_regex: "yes" + - + input: 'global update-connection-status {"id":1,"connection_status":"active","sync_status":"synced"}' + output: "ok" + stage: "global update-connection-status active success" + - + input: 'global get-agent-info 1' + output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' + stage: "global get-agent-info success after updates" + use_regex: "yes" + - + input: 'global update-connection-status {"id":1,"connection_status":"disconnected","sync_status":"syncreq"}' + output: "ok" + stage: "global update-connection-status disconnected success" + - + input: 'global get-agent-info 1' + output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' + stage: "global get-agent-info success after updates" + use_regex: "yes" + - + input: 'global update-connection-status {"id":1,"connection_status":"dummy_status","sync_status":"synced"}' + output: "err Cannot execute Global database query; CHECK constraint failed: connection_status IN ('pending', 'never_connected', 'active', 'disconnected')" + stage: "global update-connection-status dummy_status error" + - + input: 'global get-agent-info 1' + output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*}]' + stage: "global get-agent-info success after updates" + use_regex: "yes" + - + input: 'global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"}' + output: "ok" + stage: "global update-keepalive success" + - + input: 'global get-agent-info 1' + output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' + stage: "global get-agent-info success after updates" + use_regex: "yes" - - name: Labels commands - description: Check success use cases for labels table commands on global DB + name: "Labels commands" + description: "Check success use cases for labels table commands on global DB" test_case: - - - input: global get-labels 1 - output: ok [{"id":1,"key":"TestKey1","value":"TestLabel1"}]' - stage: global get-labels success + - + input: 'global get-labels 1' + output: 'ok [{"id":1,"key":"TestKey1","value":"TestLabel1"}]' + stage: "global get-labels success" - - name: Select commands - description: Check success use cases for select commands on global DB + name: "Select commands" + description: "Check success use cases for select commands on global DB" test_case: - - - input: global select-agent-name 1 - output: ok [{"name":"TestName2"}]' - stage: global select-agent-name success - - - input: global select-agent-group 1 - output: ok [{"group":"TestGroup1"}]' - stage: global select-agent-group success - - - input: global select-groups - output: ok [{"name":"default"},{"name":"TestGroup1"}]' - stage: global select-groups success + - + input: 'global select-agent-name 1' + output: 'ok [{"name":"TestName2"}]' + stage: "global select-agent-name success" + - + input: 'global select-agent-group 1' + output: 'ok [{"group":"TestGroup1"}]' + stage: "global select-agent-group success" + - + input: 'global select-groups' + output: 'ok [{"name":"default"},{"name":"TestGroup1"}]' + stage: "global select-groups success" - - name: get-all-agents command - description: Check success use cases for get-all-agents command on global DB. Chunks command + name: "get-all-agents command" + description: "Check success use cases for get-all-agents command on global DB. Chunks command" test_case: - - - input: global get-all-agents last_id -1 - output: ok [{"id":0},{"id":1},{"id":2}]' - stage: global get-all-agents success + - + input: 'global get-all-agents last_id -1' + output: 'ok [{"id":0},{"id":1},{"id":2}]' + stage: "global get-all-agents success" - - name: sync-agent-info-get command - description: Check success use cases for sync-agent-info-get command on global DB. Chunks command + name: "sync-agent-info-get command" + description: "Check success use cases for sync-agent-info-get command on global DB. Chunks command" test_case: - - - input: global sync-agent-info-get last_id 0 - output: ok [] - stage: global sync-agent-info-get success - use_regex: 'yes' - - - input: global sync-agent-info-get last_id 0 - output: ok [] - stage: global sync-agent-info-get after first get success - - - input: global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"} - output: ok - stage: global update-keepalive success + - + input: 'global sync-agent-info-get last_id 0' + output: 'ok []' + stage: "global sync-agent-info-get success" + use_regex: 'yes' + - + input: 'global sync-agent-info-get last_id 0' + output: 'ok []' + stage: "global sync-agent-info-get after first get success" + - + input: 'global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"}' + output: "ok" + stage: "global update-keepalive success" - - name: sync-agent-info-set command - description: Check success use cases for sync-agent-info-get command on global DB. + name: "sync-agent-info-set command" + description: "Check success use cases for sync-agent-info-get command on global DB." test_case: - - - input: global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","last_keepalive":200,"group_config_status":"not synced"}] - output: ok' - stage: global sync-agent-info-set non-existent agent - - - input: global get-agent-info 3 - output: ok [] - stage: global get-agent-info success after non-existent sync-agent-info-set - - - input: global delete-agent 3 - output: ok - stage: global delete-agent previous insert - - - input: global insert-agent {"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","date_add":1599223378} - output: ok - stage: global insert-agent success - - - input: global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","last_keepalive":200,"connection_status":"never_connected","disconnection_time":0, "group_config_status":"not synced"}] - output: ok' - stage: global sync-agent-info-set success - - - input: global get-agent-info 3 - output: ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":200,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' - stage: global get-agent-info success after sync-agent-info-set success + - + input: 'global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","last_keepalive":200,"group_config_status":"not synced"}]' + output: 'ok' + stage: "global sync-agent-info-set non-existent agent" + - + input: 'global get-agent-info 3' + output: 'ok []' + stage: "global get-agent-info success after non-existent sync-agent-info-set" + - + input: 'global delete-agent 3' + output: "ok" + stage: "global delete-agent previous insert" + - + input: 'global insert-agent {"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","date_add":1599223378}' + output: "ok" + stage: "global insert-agent success" + - + input: 'global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","last_keepalive":200,"connection_status":"never_connected","disconnection_time":0, "group_config_status":"not synced"}]' + output: 'ok' + stage: "global sync-agent-info-set success" + - + input: 'global get-agent-info 3' + output: 'ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":200,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' + stage: "global get-agent-info success after sync-agent-info-set success" - - name: Reset connection status - description: Check success use cases for reset connection status command. + name: "Reset connection status" + description: "Check success use cases for reset connection status command." test_case: - - - input: global update-connection-status {"id":1,"connection_status":"pending","sync_status":"synced"} - output: ok - stage: global update-connection-status pending success - - - input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"synced"} - output: ok - stage: global update-connection-status active success - - - input: global sql SELECT id,sync_status FROM agent - output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"synced"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}]' - stage: global checking sync_status before reset-agents-connection - - - input: global reset-agents-connection syncreq - output: ok' - stage: global reset-agents-connection success - - - input: global sql SELECT id,sync_status FROM agent - output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"syncreq"}]' - stage: global checking sync_status after reset-agents-connection - - - input: global get-agent-info 0 - output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' - stage: global manager get-agent-info success post reset connection status - use_regex: "yes" - - - input: global get-agent-info 1 - output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' - stage: global agent get-agent-info success post reset connection status - use_regex: "yes" - - - input: global get-agent-info 2 - output: ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' - stage: global agent get-agent-info success post reset connection status - use_regex: "yes" - - - input: global get-agent-info 3 - output: ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' - stage: global agent get-agent-info success post reset connection status - use_regex: "yes" + - + input: 'global update-connection-status {"id":1,"connection_status":"pending","sync_status":"synced"}' + output: "ok" + stage: "global update-connection-status pending success" + - + input: 'global update-connection-status {"id":3,"connection_status":"active","sync_status":"synced"}' + output: "ok" + stage: "global update-connection-status active success" + - + input: 'global sql SELECT id,sync_status FROM agent' + output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"synced"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}]' + stage: "global checking sync_status before reset-agents-connection" + - + input: 'global reset-agents-connection syncreq' + output: 'ok' + stage: "global reset-agents-connection success" + - + input: 'global sql SELECT id,sync_status FROM agent' + output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"syncreq"}]' + stage: "global checking sync_status after reset-agents-connection" + - + input: 'global get-agent-info 0' + output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' + stage: "global manager get-agent-info success post reset connection status" + use_regex: "yes" + - + input: 'global get-agent-info 1' + output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' + stage: "global agent get-agent-info success post reset connection status" + use_regex: "yes" + - + input: 'global get-agent-info 2' + output: 'ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' + stage: "global agent get-agent-info success post reset connection status" + use_regex: "yes" + - + input: 'global get-agent-info 3' + output: 'ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' + stage: "global agent get-agent-info success post reset connection status" + use_regex: "yes" - - name: get-agents-by-connection-status command - description: Check success use cases for get-agents-by-connection-status command on global DB. + name: "get-agents-by-connection-status command" + description: "Check success use cases for get-agents-by-connection-status command on global DB." test_case: - - - input: global update-connection-status {"id":1,"connection_status":"never_connected","sync_status":"syncreq"} - output: ok - stage: global update-connection-status never_connected - - - input: global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"} - output: ok - stage: global update-connection-status pending - - - input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"} - output: ok - stage: global update-connection-status active - - - input: global get-agents-by-connection-status 0 never_connected - output: ok [{"id":1}]' - stage: global get-agents-by-connection-status never_connected success - - - input: global get-agents-by-connection-status 0 pending - output: ok [{"id":2}]' - stage: global get-agents-by-connection-status pending success - - - input: global get-agents-by-connection-status 0 active - output: ok [{"id":3}]' - stage: global get-agents-by-connection-status active success - - - input: global sql SELECT id,sync_status FROM agent - output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"syncreq"},{"id":3,"sync_status":"syncreq"}]' - stage: global checking sync_status before reset-agents-connection - - - input: global reset-agents-connection synced - output: ok' - stage: global reset-agents-connection - - - input: global sql SELECT id,sync_status FROM agent - output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}]' - stage: global checking sync_status after reset-agents-connection - - - input: global get-agents-by-connection-status 0 disconnected - output: ok [{"id":2},{"id":3}]' - stage: global get-agents-by-connection-status disconnected success + - + input: 'global update-connection-status {"id":1,"connection_status":"never_connected","sync_status":"syncreq"}' + output: "ok" + stage: "global update-connection-status never_connected" + - + input: 'global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"}' + output: "ok" + stage: "global update-connection-status pending" + - + input: 'global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"}' + output: "ok" + stage: "global update-connection-status active" + - + input: 'global get-agents-by-connection-status 0 never_connected' + output: 'ok [{"id":1}]' + stage: "global get-agents-by-connection-status never_connected success" + - + input: 'global get-agents-by-connection-status 0 pending' + output: 'ok [{"id":2}]' + stage: "global get-agents-by-connection-status pending success" + - + input: 'global get-agents-by-connection-status 0 active' + output: 'ok [{"id":3}]' + stage: "global get-agents-by-connection-status active success" + - + input: 'global sql SELECT id,sync_status FROM agent' + output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"syncreq"},{"id":3,"sync_status":"syncreq"}]' + stage: "global checking sync_status before reset-agents-connection" + - + input: 'global reset-agents-connection synced' + output: 'ok' + stage: "global reset-agents-connection" + - + input: 'global sql SELECT id,sync_status FROM agent' + output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}]' + stage: "global checking sync_status after reset-agents-connection" + - + input: 'global get-agents-by-connection-status 0 disconnected' + output: 'ok [{"id":2},{"id":3}]' + stage: "global get-agents-by-connection-status disconnected success" - - name: disconnect-agents command - description: Check the right behavior of disconnect-agents command on global DB. + name: "disconnect-agents command" + description: "Check the right behavior of disconnect-agents command on global DB." test_case: - - - input: global sql UPDATE agent SET last_keepalive = 100 WHERE id = 1; - output: ok [] - stage: global updating agent's 1 keepalive to 100 - - - input: global update-connection-status {"id":1,"connection_status":"active","sync_status":"syncreq"} - output: ok - stage: global update-connection-status as active for agent 1 success - - - input: global sql UPDATE agent SET last_keepalive = 150 WHERE id = 2; - output: ok [] - stage: global updating agent's 2 keepalive to 150 - - - input: global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"} - output: ok - stage: global update-connection-status as pending for agent 2 success - - - input: global sql UPDATE agent SET last_keepalive = 200 WHERE id = 3; - output: ok [] - stage: global updating agent's 3 keepalive to 200 - - - input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"} - output: ok - stage: global update-connection-status as active for agent 3 success - - - input: global get-agents-by-connection-status 0 disconnected - output: ok [] - stage: global get-agents-by-connection-status disconnected before disconnecting agents success - - - input: global sql UPDATE agent SET sync_status = "synced" WHERE id =1 - output: ok [] - stage: global setting sync_status before disconnecting-agents command - - - input: global disconnect-agents 0 175 syncreq - output: ok [{"id":1},{"id":2}]' - stage: global disconnect-agents success - - - input: global sql SELECT id,sync_status FROM agent WHERE id =1 - output: ok [{"id":1,"sync_status":"syncreq"}]' - stage: global testing sync_status after disconnecting-agents command - - - input: global get-agents-by-connection-status 0 disconnected - output: ok [{"id":1},{"id":2}]' - stage: global get-agents-by-connection-status disconnected after disconnecting agents success + - + input: 'global sql UPDATE agent SET last_keepalive = 100 WHERE id = 1;' + output: "ok []" + stage: "global updating agent's 1 keepalive to 100" + - + input: 'global update-connection-status {"id":1,"connection_status":"active","sync_status":"syncreq"}' + output: "ok" + stage: "global update-connection-status as active for agent 1 success" + - + input: 'global sql UPDATE agent SET last_keepalive = 150 WHERE id = 2;' + output: "ok []" + stage: "global updating agent's 2 keepalive to 150" + - + input: 'global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"}' + output: "ok" + stage: "global update-connection-status as pending for agent 2 success" + - + input: 'global sql UPDATE agent SET last_keepalive = 200 WHERE id = 3;' + output: "ok []" + stage: "global updating agent's 3 keepalive to 200" + - + input: 'global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"}' + output: "ok" + stage: "global update-connection-status as active for agent 3 success" + - + input: 'global get-agents-by-connection-status 0 disconnected' + output: 'ok []' + stage: "global get-agents-by-connection-status disconnected before disconnecting agents success" + - + input: 'global sql UPDATE agent SET sync_status = "synced" WHERE id =1' + output: 'ok []' + stage: "global setting sync_status before disconnecting-agents command" + - + input: 'global disconnect-agents 0 175 syncreq' + output: 'ok [{"id":1},{"id":2}]' + stage: "global disconnect-agents success" + - + input: 'global sql SELECT id,sync_status FROM agent WHERE id =1' + output: 'ok [{"id":1,"sync_status":"syncreq"}]' + stage: "global testing sync_status after disconnecting-agents command" + - + input: 'global get-agents-by-connection-status 0 disconnected' + output: 'ok [{"id":1},{"id":2}]' + stage: "global get-agents-by-connection-status disconnected after disconnecting agents success" - - name: Delete commands - description: Check success use cases for delete commands on global DB. + name: "Delete commands" + description: "Check success use cases for delete commands on global DB." test_case: - - - input: global delete-group TestGroup1 - output: ok - stage: global delete-group after insert - - - input: global delete-agent 1 - output: ok - stage: global delete-agent after insert - - - input: global delete-agent 2 - output: ok - stage: global delete-agent after insert - - - input: global delete-agent 3 - output: ok - stage: global delete-agent after insert + - + input: 'global delete-group TestGroup1' + output: "ok" + stage: "global delete-group after insert" + - + input: 'global delete-agent 1' + output: "ok" + stage: "global delete-agent after insert" + - + input: 'global delete-agent 2' + output: "ok" + stage: "global delete-agent after insert" + - + input: 'global delete-agent 3' + output: "ok" + stage: "global delete-agent after insert" - - name: Manager keepalive - description: Check success use cases for manager keepalive. + name: "Manager keepalive" + description: "Check success use cases for manager keepalive." test_case: - - - input: global get-agent-info 0 - output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' - stage: global manager get-agent-info success pre update - use_regex: "yes" - - - input: global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","group_config_status":"not synced","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","agent_ip":"127.0.0.1","sync_status":"synced","connection_status":"active","disconnection_time":0} - output: ok - stage: global manager update-agent-data success - - - input: global get-agent-info 0 - output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' - stage: global manager get-agent-info success post update with IP - use_regex: "yes" - - - input: global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","sync_status":"synced","connection_status":"active","group_config_status":"synced"} - output: ok - stage: global manager update-agent-data success - - - input: global get-agent-info 0 - output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' - stage: global manager get-agent-info success post update without IP - use_regex: "yes" + - + input: 'global get-agent-info 0' + output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' + stage: "global manager get-agent-info success pre update" + use_regex: "yes" + - + input: 'global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","group_config_status":"not synced","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","agent_ip":"127.0.0.1","sync_status":"synced","connection_status":"active","disconnection_time":0}' + output: "ok" + stage: "global manager update-agent-data success" + - + input: 'global get-agent-info 0' + output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' + stage: "global manager get-agent-info success post update with IP" + use_regex: "yes" + - + input: 'global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","sync_status":"synced","connection_status":"active","group_config_status":"synced"}' + output: "ok" + stage: "global manager update-agent-data success" + - + input: 'global get-agent-info 0' + output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' + stage: "global manager get-agent-info success post update without IP" + use_regex: "yes" From 24da71010e049d407b6331ee7424a72f99abb428 Mon Sep 17 00:00:00 2001 From: Kevin Ledesma Date: Thu, 16 Mar 2023 17:38:28 -0300 Subject: [PATCH 05/34] style(#4022): fix some linting issues from global_messages.yaml --- .../data/global/global_messages.yaml | 753 +++++++++--------- 1 file changed, 390 insertions(+), 363 deletions(-) diff --git a/tests/integration/test_wazuh_db/data/global/global_messages.yaml b/tests/integration/test_wazuh_db/data/global/global_messages.yaml index 8db641419b..c1211074ee 100644 --- a/tests/integration/test_wazuh_db/data/global/global_messages.yaml +++ b/tests/integration/test_wazuh_db/data/global/global_messages.yaml @@ -1,387 +1,414 @@ - - name: "Insert commands" - description: "Check success use cases for insert commands on global DB" + name: Insert commands + description: Check success use cases for insert commands on global DB test_case: - - - input: 'global delete-group TestGroup1' - output: "ok" - stage: "global delete-group previous insert" - - - input: 'global find-group TestGroup1' - output: "ok []" - stage: "global find-group previous insert" - - - input: 'global insert-agent-group TestGroup1' - output: 'ok' - stage: "global insert-agent-group success" - - - input: 'global find-group default' - output: 'ok [{"id":*}]' - stage: "global find-group after insert" - use_regex: "yes" - - - input: 'global find-group TestGroup1' - output: 'ok [{"id":*}]' - stage: "global find-group after insert" - use_regex: "yes" - - - input: 'global select-groups' - output: 'ok [{"name":"default"},{"name":"TestGroup1"}]' - stage: "global select-groups success" - - - input: 'global delete-agent 1' - output: "ok" - stage: "global delete-agent previous insert" - - - input: 'global get-agent-info 1' - output: 'ok []' - stage: "global get-agent-info previous insert" - - - input: 'global insert-agent {"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","group":"TestGroup1","date_add":1599223378}' - output: "ok" - stage: "global insert-agent success" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","node_name":"unknown","date_add":1599223378,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced","status_code":0}]' - stage: "global get-agent-info after insert" - - - input: 'global find-agent {"name":"TestName1","ip":"0.0.0.1"}' - output: 'ok [{"id":1}]' - stage: "global find-agent success" - - - input: 'global delete-agent 2' - output: "ok" - stage: "global delete-agent previous insert" - - - input: 'global insert-agent {"id":2,"name":"TestName2","date_add":1599223378}' - output: "ok" - stage: "global insert-agent minimal fields success" - - - input: 'global get-agent-info 2' - output: 'ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global get-agent-info after minimal fields insert" - - - input: 'global delete-agent 2' - output: "ok" - stage: "global delete-agent after insert" - - - input: 'global insert-agent {"id":2,"name":"TestName2","date_add":1599223378}' - output: "ok" - stage: "global insert-agent agent 2 again after delete" + - + input: global delete-group TestGroup1 + output: ok + stage: global delete-group previous insert + - + input: global find-group TestGroup1 + output: ok [] + stage: global find-group previous insert + - + input: global insert-agent-group TestGroup1 + output: ok + stage: global insert-agent-group success + - + input: global find-group default + output: ok [{"id":*}] + stage: global find-group after insert + use_regex: "yes" + - + input: global find-group TestGroup1 + output: ok [{"id":*}] + stage: global find-group after insert + use_regex: "yes" + - + input: global select-groups + output: ok [{"name":"default"},{"name":"TestGroup1"}] + stage: global select-groups success + - + input: global delete-agent 1 + output: ok + stage: global delete-agent previous insert + - + input: global get-agent-info 1 + output: ok [] + stage: global get-agent-info previous insert + - + input: + global insert-agent {"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1", + "internal_key":"TopSecret","group":"TestGroup1","date_add":1599223378} + output: ok + stage: global insert-agent success + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName1","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","node_name":"unknown","date_add":1599223378,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced","status_code":0}] + stage: global get-agent-info after insert + - + input: global find-agent {"name":"TestName1","ip":"0.0.0.1"} + output: ok [{"id":1}] + stage: global find-agent success + - + input: global delete-agent 2 + output: ok + stage: global delete-agent previous insert + - + input: global insert-agent {"id":2,"name":"TestName2","date_add":1599223378} + output: ok + stage: global insert-agent minimal fields success + - + input: global get-agent-info 2 + output: ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced","status_code":0}] + stage: global get-agent-info after minimal fields insert + - + input: global delete-agent 2 + output: ok + stage: global delete-agent after insert + - + input: global insert-agent {"id":2,"name":"TestName2","date_add":1599223378} + output: ok + stage: global insert-agent agent 2 again after delete - - name: "Update commands" - description: "Check success use cases for update commands on global DB" + name: Update commands + description: Check success use cases for update commands on global DB test_case: - - - input: 'global update-agent-name {"id":1,"name":"TestName2"}' - output: "ok" - stage: "global update-agent-name success" - - - input: 'global update-agent-data {"id":1,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","agent_ip":"0.0.0.1","sync_status":"syncreq","group_config_status":"not synced","connection_status":"never_connected","labels":"TestKey1:TestLabel1"}' - output: "ok" - stage: "global update-agent-data success" - - - input: 'global update-connection-status {"id":1,"connection_status":"pending","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status pending success" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"pending","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global get-agent-info success after updates" - use_regex: "yes" - - - input: 'global update-connection-status {"id":1,"connection_status":"active","sync_status":"synced"}' - output: "ok" - stage: "global update-connection-status active success" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global get-agent-info success after updates" - use_regex: "yes" - - - input: 'global update-connection-status {"id":1,"connection_status":"disconnected","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status disconnected success" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' - stage: "global get-agent-info success after updates" - use_regex: "yes" - - - input: 'global update-connection-status {"id":1,"connection_status":"dummy_status","sync_status":"synced"}' - output: "err Cannot execute Global database query; CHECK constraint failed: connection_status IN ('pending', 'never_connected', 'active', 'disconnected')" - stage: "global update-connection-status dummy_status error" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*}]' - stage: "global get-agent-info success after updates" - use_regex: "yes" - - - input: 'global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"}' - output: "ok" - stage: "global update-keepalive success" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global get-agent-info success after updates" - use_regex: "yes" + - + input: global update-agent-name {"id":1,"name":"TestName2"} + output: ok + stage: global update-agent-name success + - + input: global update-agent-data {"id":1,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","agent_ip":"0.0.0.1","sync_status":"syncreq","group_config_status":"not synced","connection_status":"never_connected","labels":"TestKey1:TestLabel1"} + output: ok + stage: global update-agent-data success + - + input: global update-connection-status {"id":1,"connection_status":"pending","sync_status":"syncreq"} + output: ok + stage: global update-connection-status pending success + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"pending","disconnection_time":0,"group_config_status":"not synced","status_code":0}] + stage: global get-agent-info success after updates + use_regex: "yes" + - + input: global update-connection-status {"id":1,"connection_status":"active","sync_status":"synced"} + output: ok + stage: global update-connection-status active success + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret", "os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced","status_code":0}] + stage: global get-agent-info success after updates + use_regex: "yes" + - + input: global update-connection-status {"id":1,"connection_status":"disconnected","sync_status":"syncreq"} + output: ok + stage: global update-connection-status disconnected success + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced","status_code":0}] + stage: global get-agent-info success after updates + use_regex: "yes" + - + input: global update-connection-status {"id":1,"connection_status":"dummy_status","sync_status":"synced"} + output: "err Cannot execute Global database query; CHECK constraint failed: connection_status IN ('pending', 'never_connected', 'active', 'disconnected')" + stage: global update-connection-status dummy_status error + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*}] + stage: global get-agent-info success after updates + use_regex: "yes" + - + input: global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"} + output: ok + stage: global update-keepalive success + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"active","disconnection_time":0,"group_config_status":"not synced","status_code":0}] + stage: global get-agent-info success after updates + use_regex: "yes" - - name: "Labels commands" - description: "Check success use cases for labels table commands on global DB" + name: Labels commands + description: Check success use cases for labels table commands on global DB test_case: - - - input: 'global get-labels 1' - output: 'ok [{"id":1,"key":"TestKey1","value":"TestLabel1"}]' - stage: "global get-labels success" + - + input: global get-labels 1 + output: ok [{"id":1,"key":"TestKey1","value":"TestLabel1"}] + stage: global get-labels success - - name: "Select commands" - description: "Check success use cases for select commands on global DB" + name: Select commands + description: Check success use cases for select commands on global DB test_case: - - - input: 'global select-agent-name 1' - output: 'ok [{"name":"TestName2"}]' - stage: "global select-agent-name success" - - - input: 'global select-agent-group 1' - output: 'ok [{"group":"TestGroup1"}]' - stage: "global select-agent-group success" - - - input: 'global select-groups' - output: 'ok [{"name":"default"},{"name":"TestGroup1"}]' - stage: "global select-groups success" + - + input: global select-agent-name 1 + output: ok [{"name":"TestName2"}] + stage: global select-agent-name success + - + input: global select-agent-group 1 + output: ok [{"group":"TestGroup1"}] + stage: global select-agent-group success + - + input: global select-groups + output: ok [{"name":"default"},{"name":"TestGroup1"}] + stage: global select-groups success - - name: "get-all-agents command" - description: "Check success use cases for get-all-agents command on global DB. Chunks command" + name: get-all-agents command + description: Check success use cases for get-all-agents command on global DB. Chunks command test_case: - - - input: 'global get-all-agents last_id -1' - output: 'ok [{"id":0},{"id":1},{"id":2}]' - stage: "global get-all-agents success" + - + input: global get-all-agents last_id -1 + output: ok [{"id":0},{"id":1},{"id":2}] + stage: global get-all-agents success - - name: "sync-agent-info-get command" - description: "Check success use cases for sync-agent-info-get command on global DB. Chunks command" + name: sync-agent-info-get command + description: Check success use cases for sync-agent-info-get command on global DB. Chunks command test_case: - - - input: 'global sync-agent-info-get last_id 0' - output: 'ok []' - stage: "global sync-agent-info-get success" - use_regex: 'yes' - - - input: 'global sync-agent-info-get last_id 0' - output: 'ok []' - stage: "global sync-agent-info-get after first get success" - - - input: 'global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"}' - output: "ok" - stage: "global update-keepalive success" + - + input: global sync-agent-info-get last_id 0 + output: ok [] + stage: global sync-agent-info-get success + use_regex: 'yes' + - + input: global sync-agent-info-get last_id 0 + output: ok [] + stage: global sync-agent-info-get after first get success + - + input: global update-keepalive {"id":1,"sync_status":"syncreq","connection_status":"active"} + output: ok + stage: global update-keepalive success - - name: "sync-agent-info-set command" - description: "Check success use cases for sync-agent-info-get command on global DB." + name: sync-agent-info-set command + description: Check success use cases for sync-agent-info-get command on global DB. test_case: - - - input: 'global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","last_keepalive":200,"group_config_status":"not synced"}]' - output: 'ok' - stage: "global sync-agent-info-set non-existent agent" - - - input: 'global get-agent-info 3' - output: 'ok []' - stage: "global get-agent-info success after non-existent sync-agent-info-set" - - - input: 'global delete-agent 3' - output: "ok" - stage: "global delete-agent previous insert" - - - input: 'global insert-agent {"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","date_add":1599223378}' - output: "ok" - stage: "global insert-agent success" - - - input: 'global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","last_keepalive":200,"connection_status":"never_connected","disconnection_time":0, "group_config_status":"not synced"}]' - output: 'ok' - stage: "global sync-agent-info-set success" - - - input: 'global get-agent-info 3' - output: 'ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":200,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global get-agent-info success after sync-agent-info-set success" + - + input: + global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName", + "os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName", + "os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch", + "config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost", + "node_name":"TestNodeName","last_keepalive":200,"group_config_status":"not synced","status_code":0}] + output: ok + stage: global sync-agent-info-set non-existent agent + - + input: global get-agent-info 3 + output: ok [] + stage: global get-agent-info success after non-existent sync-agent-info-set + - + input: global delete-agent 3 + output: ok + stage: global delete-agent previous insert + - + input: + global insert-agent {"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3", + "internal_key":"TopSecret","date_add":1599223378} + output: ok + stage: global insert-agent success + - + input: + global sync-agent-info-set [{"id":3,"name":"TestName3","ip":"0.0.0.3","os_name":"TestOsName", + "os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor", + "os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor", + "os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum", + "manager_host":"TestManagerHost","node_name":"TestNodeName","last_keepalive":200, + "connection_status":"never_connected","disconnection_time":0, "group_config_status":"not synced", + "status_code":0}] + output: ok + stage: global sync-agent-info-set success + - + input: global get-agent-info 3 + output: ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":200,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced","status_code":0}] + stage: global get-agent-info success after sync-agent-info-set success - - name: "Reset connection status" - description: "Check success use cases for reset connection status command." + name: Reset connection status + description: Check success use cases for reset connection status command. test_case: - - - input: 'global update-connection-status {"id":1,"connection_status":"pending","sync_status":"synced"}' - output: "ok" - stage: "global update-connection-status pending success" - - - input: 'global update-connection-status {"id":3,"connection_status":"active","sync_status":"synced"}' - output: "ok" - stage: "global update-connection-status active success" - - - input: 'global sql SELECT id,sync_status FROM agent' - output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"synced"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}]' - stage: "global checking sync_status before reset-agents-connection" - - - input: 'global reset-agents-connection syncreq' - output: 'ok' - stage: "global reset-agents-connection success" - - - input: 'global sql SELECT id,sync_status FROM agent' - output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"syncreq"}]' - stage: "global checking sync_status after reset-agents-connection" - - - input: 'global get-agent-info 0' - output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' - stage: "global manager get-agent-info success post reset connection status" - use_regex: "yes" - - - input: 'global get-agent-info 1' - output: 'ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' - stage: "global agent get-agent-info success post reset connection status" - use_regex: "yes" - - - input: 'global get-agent-info 2' - output: 'ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global agent get-agent-info success post reset connection status" - use_regex: "yes" - - - input: 'global get-agent-info 3' - output: 'ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced"}]' - stage: "global agent get-agent-info success post reset connection status" - use_regex: "yes" + - + input: global update-connection-status {"id":1,"connection_status":"pending","sync_status":"synced"} + output: ok + stage: global update-connection-status pending success + - + input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"synced"} + output: ok + stage: global update-connection-status active success + - + input: global sql SELECT id,sync_status FROM agent + output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"synced"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}] + stage: global checking sync_status before reset-agents-connection + - + input: global reset-agents-connection syncreq + output: ok + stage: global reset-agents-connection success + - + input: global sql SELECT id,sync_status FROM agent + output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"syncreq"}] + stage: global checking sync_status after reset-agents-connection + - + input: global get-agent-info 0 + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}] + stage: global manager get-agent-info success post reset connection status + use_regex: "yes" + - + input: global get-agent-info 1 + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced","status_code":0}] + stage: global agent get-agent-info success post reset connection status + use_regex: "yes" + - + input: global get-agent-info 2 + output: ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}] + stage: global agent get-agent-info success post reset connection status + use_regex: "yes" + - + input: global get-agent-info 3 + output: ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced","status_code":0}] + stage: global agent get-agent-info success post reset connection status + use_regex: "yes" - - name: "get-agents-by-connection-status command" - description: "Check success use cases for get-agents-by-connection-status command on global DB." + name: get-agents-by-connection-status command + description: Check success use cases for get-agents-by-connection-status command on global DB. test_case: - - - input: 'global update-connection-status {"id":1,"connection_status":"never_connected","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status never_connected" - - - input: 'global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status pending" - - - input: 'global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status active" - - - input: 'global get-agents-by-connection-status 0 never_connected' - output: 'ok [{"id":1}]' - stage: "global get-agents-by-connection-status never_connected success" - - - input: 'global get-agents-by-connection-status 0 pending' - output: 'ok [{"id":2}]' - stage: "global get-agents-by-connection-status pending success" - - - input: 'global get-agents-by-connection-status 0 active' - output: 'ok [{"id":3}]' - stage: "global get-agents-by-connection-status active success" - - - input: 'global sql SELECT id,sync_status FROM agent' - output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"syncreq"},{"id":3,"sync_status":"syncreq"}]' - stage: "global checking sync_status before reset-agents-connection" - - - input: 'global reset-agents-connection synced' - output: 'ok' - stage: "global reset-agents-connection" - - - input: 'global sql SELECT id,sync_status FROM agent' - output: 'ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}]' - stage: "global checking sync_status after reset-agents-connection" - - - input: 'global get-agents-by-connection-status 0 disconnected' - output: 'ok [{"id":2},{"id":3}]' - stage: "global get-agents-by-connection-status disconnected success" + - + input: global update-connection-status {"id":1,"connection_status":"never_connected","sync_status":"syncreq"} + output: ok + stage: global update-connection-status never_connected + - + input: global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"} + output: ok + stage: global update-connection-status pending + - + input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"} + output: ok + stage: global update-connection-status active + - + input: global get-agents-by-connection-status 0 never_connected + output: ok [{"id":1}] + stage: global get-agents-by-connection-status never_connected success + - + input: global get-agents-by-connection-status 0 pending + output: ok [{"id":2}] + stage: global get-agents-by-connection-status pending success + - + input: global get-agents-by-connection-status 0 active + output: ok [{"id":3}] + stage: global get-agents-by-connection-status active success + - + input: global sql SELECT id,sync_status FROM agent + output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"syncreq"},{"id":3,"sync_status":"syncreq"}] + stage: global checking sync_status before reset-agents-connection + - + input: global reset-agents-connection synced + output: ok + stage: global reset-agents-connection + - + input: global sql SELECT id,sync_status FROM agent + output: ok [{"id":0,"sync_status":"synced"},{"id":1,"sync_status":"syncreq"},{"id":2,"sync_status":"synced"},{"id":3,"sync_status":"synced"}] + stage: global checking sync_status after reset-agents-connection + - + input: global get-agents-by-connection-status 0 disconnected + output: ok [{"id":2},{"id":3}] + stage: global get-agents-by-connection-status disconnected success - - name: "disconnect-agents command" - description: "Check the right behavior of disconnect-agents command on global DB." + name: disconnect-agents command + description: Check the right behavior of disconnect-agents command on global DB. test_case: - - - input: 'global sql UPDATE agent SET last_keepalive = 100 WHERE id = 1;' - output: "ok []" - stage: "global updating agent's 1 keepalive to 100" - - - input: 'global update-connection-status {"id":1,"connection_status":"active","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status as active for agent 1 success" - - - input: 'global sql UPDATE agent SET last_keepalive = 150 WHERE id = 2;' - output: "ok []" - stage: "global updating agent's 2 keepalive to 150" - - - input: 'global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status as pending for agent 2 success" - - - input: 'global sql UPDATE agent SET last_keepalive = 200 WHERE id = 3;' - output: "ok []" - stage: "global updating agent's 3 keepalive to 200" - - - input: 'global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"}' - output: "ok" - stage: "global update-connection-status as active for agent 3 success" - - - input: 'global get-agents-by-connection-status 0 disconnected' - output: 'ok []' - stage: "global get-agents-by-connection-status disconnected before disconnecting agents success" - - - input: 'global sql UPDATE agent SET sync_status = "synced" WHERE id =1' - output: 'ok []' - stage: "global setting sync_status before disconnecting-agents command" - - - input: 'global disconnect-agents 0 175 syncreq' - output: 'ok [{"id":1},{"id":2}]' - stage: "global disconnect-agents success" - - - input: 'global sql SELECT id,sync_status FROM agent WHERE id =1' - output: 'ok [{"id":1,"sync_status":"syncreq"}]' - stage: "global testing sync_status after disconnecting-agents command" - - - input: 'global get-agents-by-connection-status 0 disconnected' - output: 'ok [{"id":1},{"id":2}]' - stage: "global get-agents-by-connection-status disconnected after disconnecting agents success" + - + input: global sql UPDATE agent SET last_keepalive = 100 WHERE id = 1; + output: ok [] + stage: global updating agent's 1 keepalive to 100 + - + input: global update-connection-status {"id":1,"connection_status":"active","sync_status":"syncreq"} + output: ok + stage: global update-connection-status as active for agent 1 success + - + input: global sql UPDATE agent SET last_keepalive = 150 WHERE id = 2; + output: ok [] + stage: global updating agent's 2 keepalive to 150 + - + input: global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"} + output: ok + stage: global update-connection-status as pending for agent 2 success + - + input: global sql UPDATE agent SET last_keepalive = 200 WHERE id = 3; + output: ok [] + stage: global updating agent's 3 keepalive to 200 + - + input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"} + output: ok + stage: global update-connection-status as active for agent 3 success + - + input: global get-agents-by-connection-status 0 disconnected + output: ok [] + stage: global get-agents-by-connection-status disconnected before disconnecting agents success + - + input: global sql UPDATE agent SET sync_status = "synced" WHERE id =1 + output: ok [] + stage: global setting sync_status before disconnecting-agents command + - + input: global disconnect-agents 0 175 syncreq + output: ok [{"id":1},{"id":2}] + stage: global disconnect-agents success + - + input: global sql SELECT id,sync_status FROM agent WHERE id =1 + output: ok [{"id":1,"sync_status":"syncreq"}] + stage: global testing sync_status after disconnecting-agents command + - + input: global get-agents-by-connection-status 0 disconnected + output: ok [{"id":1},{"id":2}] + stage: global get-agents-by-connection-status disconnected after disconnecting agents success - - name: "Delete commands" - description: "Check success use cases for delete commands on global DB." + name: Delete commands + description: Check success use cases for delete commands on global DB. test_case: - - - input: 'global delete-group TestGroup1' - output: "ok" - stage: "global delete-group after insert" - - - input: 'global delete-agent 1' - output: "ok" - stage: "global delete-agent after insert" - - - input: 'global delete-agent 2' - output: "ok" - stage: "global delete-agent after insert" - - - input: 'global delete-agent 3' - output: "ok" - stage: "global delete-agent after insert" + - + input: global delete-group TestGroup1 + output: ok + stage: global delete-group after insert + - + input: global delete-agent 1 + output: ok + stage: global delete-agent after insert + - + input: global delete-agent 2 + output: ok + stage: global delete-agent after insert + - + input: global delete-agent 3 + output: ok + stage: global delete-agent after insert - - name: "Manager keepalive" - description: "Check success use cases for manager keepalive." + name: Manager keepalive + description: Check success use cases for manager keepalive. test_case: - - - input: 'global get-agent-info 0' - output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' - stage: "global manager get-agent-info success pre update" - use_regex: "yes" - - - input: 'global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","group_config_status":"not synced","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","agent_ip":"127.0.0.1","sync_status":"synced","connection_status":"active","disconnection_time":0}' - output: "ok" - stage: "global manager update-agent-data success" - - - input: 'global get-agent-info 0' - output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}]' - stage: "global manager get-agent-info success post update with IP" - use_regex: "yes" - - - input: 'global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","sync_status":"synced","connection_status":"active","group_config_status":"synced"}' - output: "ok" - stage: "global manager update-agent-data success" - - - input: 'global get-agent-info 0' - output: 'ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}]' - stage: "global manager get-agent-info success post update without IP" - use_regex: "yes" + - + input: global get-agent-info 0 + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}] + stage: global manager get-agent-info success pre update + use_regex: "yes" + - + input: + global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor", + "os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor","os_build":"TestOsBuild", + "os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","group_config_status":"not synced", + "config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost", + "node_name":"TestNodeName","agent_ip":"127.0.0.1","sync_status":"synced","connection_status":"active", + "disconnection_time":0} + output: ok + stage: global manager update-agent-data success + - + input: global get-agent-info 0 + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}] + stage: global manager get-agent-info success post update with IP + use_regex: "yes" + - + input: + global update-agent-data {"id":0,"os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor", + "os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor", + "os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion", + "config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost", + "node_name":"TestNodeName","sync_status":"synced","connection_status":"active","group_config_status":"synced"} + output: ok + stage: global manager update-agent-data success + - + input: global get-agent-info 0 + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}] + stage: global manager get-agent-info success post update without IP + use_regex: "yes" From e84230a372251f418dd38371da6f876730ff92b6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julia=20Mag=C3=A1n?= <80041853+juliamagan@users.noreply.github.com> Date: Fri, 17 Mar 2023 12:34:58 +0100 Subject: [PATCH 06/34] fix(3862): fix test_assign_agent_group_with_enrollment * fix(#3862): delete default group check * feat(#3862): update changelog * refactor(#3862): add expected logs --- CHANGELOG.md | 1 + .../data/enrollment_group_messages.yaml | 4 ++ ...test_assign_agent_group_with_enrollment.py | 47 +++++++------------ 3 files changed, 21 insertions(+), 31 deletions(-) create mode 100644 tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index b062adc0a8..98e4026f56 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -49,6 +49,7 @@ Release report: TBD ### Changed +- Fix `test_assign_agent_group_with_enrollment` ([#3956](https://github.com/wazuh/wazuh-qa/pull/3956)) \- (Tests) - Fix `test_file_limit_delete_full` module ([#3990](https://github.com/wazuh/wazuh-qa/pull/3990)) \- (Tests) - Improve `test_agent_groups_new_cluster_node` ([#3971](https://github.com/wazuh/wazuh-qa/pull/3971)) \- (Tests) - Fix Solaris agent provision schema ([#3750](https://github.com/wazuh/wazuh-qa/issues/3744)) \- (Framework) diff --git a/tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml b/tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml new file mode 100644 index 0000000000..3e627d9848 --- /dev/null +++ b/tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml @@ -0,0 +1,4 @@ +wazuh-master: + - regex: .*Agent-groups send full.*Finished in.* + path: var/ossec/logs/cluster.log + timeout: 60 diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py index f06566f55a..1b1201ac78 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py @@ -45,8 +45,9 @@ import time import pytest -from system import (AGENT_GROUPS_DEFAULT, ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, restart_cluster, - check_keys_file, delete_group_of_agents, check_agent_groups_db) +from system import (ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, restart_cluster, check_keys_file, delete_group_of_agents, + check_agent_groups_db) +from wazuh_testing.tools.monitoring import HostMonitor from wazuh_testing.tools.system import HostManager from wazuh_testing.tools import WAZUH_PATH @@ -62,11 +63,12 @@ host_manager = HostManager(inventory_path) local_path = os.path.dirname(os.path.abspath(__file__)) tmp_path = os.path.join(local_path, 'tmp') +data_path = os.path.join(local_path, 'data') +messages_path = os.path.join(data_path, 'enrollment_group_messages.yaml') + # Variables -timeout = 15 id_group = 'group_test' -path_cluster = '/framework/python/lib/python3.9/site-packages/wazuh-4.4.0-py3.9.egg/wazuh/core/cluster/cluster.json' enrollment_group = f""" {id_group} @@ -78,9 +80,8 @@ @pytest.mark.parametrize("agent_target", ["wazuh-worker1"]) def test_assign_agent_to_a_group(agent_target, clean_environment): ''' - description: Check race condition when an agent enrollment process with a group connects to the worker, - when worker no receive information about the group and when data of groups is receive, - the group is change. + description: Check that when an agent registers in a worker, with a group assigned in the enrollment section, + the agent has that group assigned in the worker's database. wazuh_min_version: 4.4.0 parameters: - agent_target: @@ -91,22 +92,14 @@ def test_assign_agent_to_a_group(agent_target, clean_environment): brief: Reset the wazuh log files at the start of the test. Remove all registered agents from master. assertions: - Verify that after registering the agent key file exists in all nodes. - - Verify that after registering and before receiving agent group info, it has the 'default' group assigned. - Verify that after registering and after receiving agent group info, it has the 'group_test' group assigned. expected_output: - The agent 'Agent_name' with ID 'Agent_id' belongs to groups: group_test." ''' - replace = '\n' + ' "timeout_agent_groups": 40,' '\n' + ' "agent_group_start_delay": 300,\n' - - # Add modify agent_group_start_delay - host_manager.add_block_to_file(host=test_infra_managers[0], path=f"{WAZUH_PATH}{path_cluster}", - after='"timeout_agent_info": 40,', before='"check_worker_lastkeepalive": 60,', - replace=replace) - # Create new group host_manager.run_command(test_infra_managers[0], f"/var/ossec/bin/agent_groups -q -a -g {id_group}") - worker_ip = host_manager.run_command(agent_target, f'hostname -i') + worker_ip = host_manager.run_command(agent_target, 'hostname -i') # Modify ossec.conf in agent host_manager.add_block_to_file(host=test_infra_agents[0], path=f"{WAZUH_PATH}/etc/ossec.conf", @@ -114,27 +107,19 @@ def test_assign_agent_to_a_group(agent_target, clean_environment): host_manager.add_block_to_file(host=test_infra_agents[0], path=f"{WAZUH_PATH}/etc/ossec.conf", after="
", before="
", replace=worker_ip) - restart_cluster([test_infra_managers[0]] + test_infra_agents, host_manager) - time.sleep(timeout) + restart_cluster(test_infra_agents, host_manager) + + # Wait to Agent-groups send full task to end due to race condition + HostMonitor(inventory_path=inventory_path, + messages_path=messages_path, + tmp_path=tmp_path).run(update_position=True) # Check that agent has client key file assert check_keys_file(test_infra_agents[0], host_manager), ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND try: - # Chech that the worker has the default group + # Check that agent has expected group assigned query = 'sql select id, `group` from agent;' - check_agent_groups_db(query, AGENT_GROUPS_DEFAULT, test_infra_managers[1], host_manager) - - replace = '\n' + ' "timeout_agent_groups": 40,' '\n' + ' "agent_group_start_delay": 1,\n' - - # Add modify agent_group_start_delay - host_manager.add_block_to_file(host=test_infra_managers[0], path=f"{WAZUH_PATH}{path_cluster}", - after='"timeout_agent_info": 40,', before='"check_worker_lastkeepalive": 60,', - replace=replace) - - restart_cluster([test_infra_managers[0]], host_manager) - time.sleep(timeout) - # Check that agent has group set to default and then override group info check_agent_groups_db(query, id_group, test_infra_managers[1], host_manager) finally: From 02bc78c9e05943411c6060f482414256e5f77a45 Mon Sep 17 00:00:00 2001 From: Kevin Ledesma Date: Fri, 17 Mar 2023 09:44:06 -0300 Subject: [PATCH 07/34] fix(#4022): add status_code to queries --- .../data/global/global_messages.yaml | 48 +++++++++---------- .../test_wazuh_db/test_wazuh_db.py | 3 +- 2 files changed, 26 insertions(+), 25 deletions(-) diff --git a/tests/integration/test_wazuh_db/data/global/global_messages.yaml b/tests/integration/test_wazuh_db/data/global/global_messages.yaml index c1211074ee..45f836b91b 100644 --- a/tests/integration/test_wazuh_db/data/global/global_messages.yaml +++ b/tests/integration/test_wazuh_db/data/global/global_messages.yaml @@ -83,34 +83,34 @@ output: ok stage: global update-agent-data success - - input: global update-connection-status {"id":1,"connection_status":"pending","sync_status":"syncreq"} + input: global update-connection-status {"id":1,"connection_status":"pending","sync_status":"syncreq","status_code":1} output: ok stage: global update-connection-status pending success - input: global get-agent-info 1 - output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"pending","disconnection_time":0,"group_config_status":"not synced","status_code":0}] + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"pending","disconnection_time":0,"group_config_status":"not synced","status_code":1}] stage: global get-agent-info success after updates use_regex: "yes" - - input: global update-connection-status {"id":1,"connection_status":"active","sync_status":"synced"} + input: global update-connection-status {"id":1,"connection_status":"active","sync_status":"synced","status_code":0} output: ok stage: global update-connection-status active success - input: global get-agent-info 1 - output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret", "os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced","status_code":0}] + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced","status_code":0}] stage: global get-agent-info success after updates use_regex: "yes" - - input: global update-connection-status {"id":1,"connection_status":"disconnected","sync_status":"syncreq"} + input: global update-connection-status {"id":1,"connection_status":"disconnected","sync_status":"syncreq","status_code":1} output: ok stage: global update-connection-status disconnected success - input: global get-agent-info 1 - output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced","status_code":0}] + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced","status_code":1}] stage: global get-agent-info success after updates use_regex: "yes" - - input: global update-connection-status {"id":1,"connection_status":"dummy_status","sync_status":"synced"} + input: global update-connection-status {"id":1,"connection_status":"dummy_status","sync_status":"synced","status_code":0} output: "err Cannot execute Global database query; CHECK constraint failed: connection_status IN ('pending', 'never_connected', 'active', 'disconnected')" stage: global update-connection-status dummy_status error - @@ -223,11 +223,11 @@ description: Check success use cases for reset connection status command. test_case: - - input: global update-connection-status {"id":1,"connection_status":"pending","sync_status":"synced"} + input: global update-connection-status {"id":1,"connection_status":"pending","sync_status":"synced","status_code":1} output: ok stage: global update-connection-status pending success - - input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"synced"} + input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"synced","status_code":0} output: ok stage: global update-connection-status active success - @@ -244,22 +244,22 @@ stage: global checking sync_status after reset-agents-connection - input: global get-agent-info 0 - output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}] + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced","status_code":0}] stage: global manager get-agent-info success post reset connection status use_regex: "yes" - input: global get-agent-info 1 - output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced","status_code":0}] + output: ok [{"id":1,"name":"TestName2","ip":"0.0.0.1","register_ip":"0.0.0.1","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group":"TestGroup1","group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced","status_code":5}] stage: global agent get-agent-info success post reset connection status use_regex: "yes" - input: global get-agent-info 2 - output: ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced"}] + output: ok [{"id":2,"name":"TestName2","node_name":"unknown","date_add":1599223378,"group_sync_status":"synced","sync_status":"synced","connection_status":"never_connected","disconnection_time":0,"group_config_status":"not synced","status_code":0}] stage: global agent get-agent-info success post reset connection status use_regex: "yes" - input: global get-agent-info 3 - output: ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced","status_code":0}] + output: ok [{"id":3,"name":"TestName3","ip":"0.0.0.3","register_ip":"0.0.0.3","internal_key":"TopSecret","os_name":"TestOsName","os_version":"TestOsVersion","os_major":"TestOsMajor","os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_build":"TestOsBuild","os_platform":"TestOsPlatfor","os_uname":"TestOsUname","os_arch":"TestOsArch","config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost","node_name":"TestNodeName","date_add":1599223378,"last_keepalive":*,"group_sync_status":"synced","sync_status":"syncreq","connection_status":"disconnected","disconnection_time":*,"group_config_status":"not synced","status_code":5}] stage: global agent get-agent-info success post reset connection status use_regex: "yes" - @@ -267,15 +267,15 @@ description: Check success use cases for get-agents-by-connection-status command on global DB. test_case: - - input: global update-connection-status {"id":1,"connection_status":"never_connected","sync_status":"syncreq"} + input: global update-connection-status {"id":1,"connection_status":"never_connected","sync_status":"syncreq","status_code":1} output: ok stage: global update-connection-status never_connected - - input: global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"} + input: global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq","status_code":1} output: ok stage: global update-connection-status pending - - input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"} + input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq","status_code":0} output: ok stage: global update-connection-status active - @@ -315,7 +315,7 @@ output: ok [] stage: global updating agent's 1 keepalive to 100 - - input: global update-connection-status {"id":1,"connection_status":"active","sync_status":"syncreq"} + input: global update-connection-status {"id":1,"connection_status":"active","sync_status":"syncreq","status_code":0} output: ok stage: global update-connection-status as active for agent 1 success - @@ -323,7 +323,7 @@ output: ok [] stage: global updating agent's 2 keepalive to 150 - - input: global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq"} + input: global update-connection-status {"id":2,"connection_status":"pending","sync_status":"syncreq","status_code":1} output: ok stage: global update-connection-status as pending for agent 2 success - @@ -331,7 +331,7 @@ output: ok [] stage: global updating agent's 3 keepalive to 200 - - input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq"} + input: global update-connection-status {"id":3,"connection_status":"active","sync_status":"syncreq","status_code":0} output: ok stage: global update-connection-status as active for agent 3 success - @@ -380,7 +380,7 @@ test_case: - input: global get-agent-info 0 - output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}] + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced","status_code":0}] stage: global manager get-agent-info success pre update use_regex: "yes" - @@ -390,12 +390,12 @@ "os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion","group_config_status":"not synced", "config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost", "node_name":"TestNodeName","agent_ip":"127.0.0.1","sync_status":"synced","connection_status":"active", - "disconnection_time":0} + "disconnection_time":0,"status_code":0} output: ok stage: global manager update-agent-data success - input: global get-agent-info 0 - output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced"}] + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"not synced","status_code":0}] stage: global manager get-agent-info success post update with IP use_regex: "yes" - @@ -404,11 +404,11 @@ "os_minor":"TestOsMinor","os_codename":"TestOsCodeName","os_platform":"TestOsPlatfor", "os_build":"TestOsBuild","os_uname":"TestOsUname","os_arch":"TestOsArch","version":"TestVersion", "config_sum":"TestConfigSum","merged_sum":"TestMergedSum","manager_host":"TestManagerHost", - "node_name":"TestNodeName","sync_status":"synced","connection_status":"active","group_config_status":"synced"} + "node_name":"TestNodeName","sync_status":"synced","connection_status":"active","group_config_status":"synced","status_code":0} output: ok stage: global manager update-agent-data success - input: global get-agent-info 0 - output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced"}] + output: ok [{"id":0,*,"last_keepalive":253402300799,"group_sync_status":"synced","sync_status":"synced","connection_status":"active","disconnection_time":0,"group_config_status":"synced","status_code":0}] stage: global manager get-agent-info success post update without IP use_regex: "yes" diff --git a/tests/integration/test_wazuh_db/test_wazuh_db.py b/tests/integration/test_wazuh_db/test_wazuh_db.py index f4e7372dc8..5e2d799465 100644 --- a/tests/integration/test_wazuh_db/test_wazuh_db.py +++ b/tests/integration/test_wazuh_db/test_wazuh_db.py @@ -257,7 +257,8 @@ def insert_agent(agent_id, agent_name='TestName'): update_data = json.dumps({'id': agent_id, 'sync_status': 'syncreq', - 'connection_status': 'active' + 'connection_status': 'active', + 'status_code': 0 }) command = f"global insert-agent {insert_data}" From 17fce1739e1918503f14e87b60f9e1270b776edb Mon Sep 17 00:00:00 2001 From: Kevin Ledesma Date: Fri, 17 Mar 2023 10:33:34 -0300 Subject: [PATCH 08/34] docs(#4022): update CHANGELOG --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index bc56c6a0fa..8ed1542f35 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,7 @@ Release report: TBD ### Changed +- Update `test_wazuh_db` & `test_enrollment` to support new column `status_code` and new value on the enrollment `payload`. ([#4021](https://github.com/wazuh/wazuh-qa/pull/4021)) \- (Tests) - Update FIM `test_audit` tests to new framework ([#3939](https://github.com/wazuh/wazuh-qa/pull/3939)) \- (Framework + Tests) - Update FIM test to new FIM DBSync process ([#2728](https://github.com/wazuh/wazuh-qa/pull/2728)) \- (Framework + Tests) - Update file_limit and registry_limit tests ([#3280](https://github.com/wazuh/wazuh-qa/pull/3280)) \- (Tests) From 6b28ec63004f6658233468c6d458d3f362f2d392 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bel=C3=A9n=20Valdivia?= Date: Fri, 17 Mar 2023 13:02:34 -0300 Subject: [PATCH 09/34] fix(#4026): solve a bug of migration tool framework * fix(#4020): fixed migration tool * feat(#4026): add new changes in the changelog --- CHANGELOG.md | 1 + deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bc56c6a0fa..efb2190b9d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -35,6 +35,7 @@ Release report: TBD - Fix imports and add windows support for test_report_changes_and_diff IT ([#3548](https://github.com/wazuh/wazuh-qa/issues/3548)) \- (Framework + Tests) - Fix a regex error in the FIM integration tests ([#3061](https://github.com/wazuh/wazuh-qa/issues/3061)) \- (Framework + Tests) - Fix an error in the cluster performance tests related to CSV parser ([#2999](https://github.com/wazuh/wazuh-qa/pull/2999)) \- (Framework + Tests) +- Fix bug in the framework on migration tool ([#2999](https://github.com/wazuh/wazuh-qa/pull/4027)) \- (Framework) ## [4.4.0] - Development (unreleased) diff --git a/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py b/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py index d74f117834..0394aebdb5 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py +++ b/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py @@ -178,7 +178,8 @@ def clean_migration_tool_output_files(): for output_folder in output_folders: for folder in vendors_folders: folder = os.path.join(output_folder, folder) - delete_all_files_in_folder(folder) + if os.path.exists(folder): + delete_all_files_in_folder(folder) def drop_migration_tool_tables(): From 998b99e2e7c6dce47c1fd1cf681d6a1bffd6b63c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Luis=20L=C3=B3pez=20S=C3=A1nchez?= Date: Mon, 27 Mar 2023 11:57:55 +0200 Subject: [PATCH 10/34] fix(#4047): fix duplicated slash in API endpoint (#4048) --- CHANGELOG.md | 1 + tests/integration/test_api/conftest.py | 8 +++++--- .../test_middlewares/test_response_postprocessing.py | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 98e4026f56..ae3e166f3f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -111,6 +111,7 @@ Release report: TBD - Fix error in requirements.txt ([#3689](https://github.com/wazuh/wazuh-qa/pull/3689)) \- (Framework) - Fix sleep time in `test_agent_default_group_added`. ([#3692](https://github.com/wazuh/wazuh-qa/pull/3692)) \- (Tests) - Fix syscollector deltas integration tests. ([#3695](https://github.com/wazuh/wazuh-qa/pull/3695)) \- (Tests) +- Fix test_response_postprocessing: duplicated slash in API endpoints ([#4048](https://github.com/wazuh/wazuh-qa/pull/4048)) \- (Tests) ### Removed diff --git a/tests/integration/test_api/conftest.py b/tests/integration/test_api/conftest.py index b83d7419a5..eae910d6a8 100644 --- a/tests/integration/test_api/conftest.py +++ b/tests/integration/test_api/conftest.py @@ -4,15 +4,16 @@ import os import shutil + import pytest import wazuh_testing as fw from wazuh_testing import api -from wazuh_testing.tools.file import truncate_file -from wazuh_testing.tools.monitoring import FileMonitor -from wazuh_testing.tools import services as svcs from wazuh_testing.modules.api import event_monitor as evm from wazuh_testing.tools import configuration as conf +from wazuh_testing.tools import services as svcs +from wazuh_testing.tools.file import truncate_file +from wazuh_testing.tools.monitoring import FileMonitor @pytest.fixture(scope='module') @@ -144,6 +145,7 @@ def restart_api_module(request): # Start Wazuh API svcs.control_service('start') + evm.check_api_start_log(file_monitor) @pytest.fixture(scope='module') diff --git a/tests/integration/test_api/test_middlewares/test_response_postprocessing.py b/tests/integration/test_api/test_middlewares/test_response_postprocessing.py index fd92f858ce..166c7340a7 100644 --- a/tests/integration/test_api/test_middlewares/test_response_postprocessing.py +++ b/tests/integration/test_api/test_middlewares/test_response_postprocessing.py @@ -122,7 +122,7 @@ def test_response_postprocessing(restart_api_module, get_api_details, method, en headers = api_details['auth_headers'] if use_login_token else api.get_login_headers('wrong_user', 'wrong_password') # Make an API request - response = getattr(requests, method.lower())(f"{api_details['base_url']}/{endpoint_url}", headers=headers, + response = getattr(requests, method.lower())(f"{api_details['base_url']}{endpoint_url}", headers=headers, verify=False, json=json_body) assert response.headers['Content-Type'] == 'application/problem+json; charset=utf-8' From 3135ba9b3c23cb92bd96b460c5c262f4a8ac9dec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julia=20Mag=C3=A1n?= <80041853+juliamagan@users.noreply.github.com> Date: Fri, 31 Mar 2023 10:40:34 +0200 Subject: [PATCH 11/34] refactor: update changelog * refactor: bump version to 4.3.10 * refactor: update changelog --------- Co-authored-by: jmv74211 --- CHANGELOG.md | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ae3e166f3f..87946aa351 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,15 +2,14 @@ All notable changes to this project will be documented in this file. -## [4.4.0] - Development (unreleased) +## [4.4.0] - 28-03-2023 -Wazuh commit: TBD \ -Release report: TBD +Wazuh commit: https://github.com/wazuh/wazuh/commit/2477e9fa50bc1424e834ac8401ce2450a5978e75 \ +Release report: https://github.com/wazuh/wazuh/issues/15504 ### Added - Add multigroups tests cases for `test_assign_groups_guess` ([#3979](https://github.com/wazuh/wazuh-qa/pull/3979)) \- (Tests) -- Fix test_agent_groups system test ([#3955](https://github.com/wazuh/wazuh-qa/pull/3964)) \- (Tests) - Add new group_hash case and update the `without condition` case output in `wazuh_db/sync_agent_groups_get` ([#3959](https://github.com/wazuh/wazuh-qa/pull/3959)) \- (Tests) - Add markers for each system test environment ([#3961](https://github.com/wazuh/wazuh-qa/pull/3961)) \- (Framework + Tests) - Adapt binary performance module to wazuh-cluster script renaming ([#3944](https://github.com/wazuh/wazuh-qa/pull/3944)) \- (Framework) @@ -22,7 +21,6 @@ Release report: TBD - Add new test to check vulnerable packages with triaged null([#3587](https://github.com/wazuh/wazuh-qa/pull/3587)) \- (Framework + Tests) - Add new tests analysid handling of invalid/empty rule signature IDs ([#3649](https://github.com/wazuh/wazuh-qa/pull/3649)) \- (Framework + Tests) - Add integration test to check agent database version ([#3768](https://github.com/wazuh/wazuh-qa/pull/3768)) \- (Tests) -- Fix Yara and VirusTotal E2E basic usage tests ([#3660](https://github.com/wazuh/wazuh-qa/pull/3660)) - Add new test to check if syslog message are parsed correctrly in the `archives.json` file ([#3609](https://github.com/wazuh/wazuh-qa/pull/3609)) \- (Framework + Tests) - Add new logging tests for analysisd EPS limitation ([#3509](https://github.com/wazuh/wazuh-qa/pull/3509)) \- (Framework + Tests) - New testing suite for checking analysisd EPS limitation ([#2947](https://github.com/wazuh/wazuh-qa/pull/3181)) \- (Framework + Tests) @@ -49,15 +47,9 @@ Release report: TBD ### Changed -- Fix `test_assign_agent_group_with_enrollment` ([#3956](https://github.com/wazuh/wazuh-qa/pull/3956)) \- (Tests) -- Fix `test_file_limit_delete_full` module ([#3990](https://github.com/wazuh/wazuh-qa/pull/3990)) \- (Tests) - Improve `test_agent_groups_new_cluster_node` ([#3971](https://github.com/wazuh/wazuh-qa/pull/3971)) \- (Tests) -- Fix Solaris agent provision schema ([#3750](https://github.com/wazuh/wazuh-qa/issues/3744)) \- (Framework) -- Fix wazuh-db integration tests for agent-groups ([#3926](https://github.com/wazuh/wazuh-qa/pull/3926)) \- (Tests + Framework) -- Fix `test_set_agent_groups` ([#3920](https://github.com/wazuh/wazuh-qa/pull/3920)) \- (Tests) - Improve `test_assign_groups_guess` ([#3901](https://github.com/wazuh/wazuh-qa/pull/3901)) \- (Tests) - Update `test_cluster_worker_logs_order` test ([#3896](https://github.com/wazuh/wazuh-qa/pull/3896)) \- (Tests) -- Fix `test_agent_groups` ([#3889](https://github.com/wazuh/wazuh-qa/pull/3889)) \- (Tests + Framework) - Increase NVE download feed test timeout([#3769](https://github.com/wazuh/wazuh-qa/pull/3769)) \- (Tests) - Adapt wazuhdb integration tests for auto-vacuum ([#3613](https://github.com/wazuh/wazuh-qa/issues/3613)) \- (Tests) - Update logcollector format test due to audit changes ([#3641](https://github.com/wazuh/wazuh-qa/pull/3641)) \- (Framework) @@ -97,8 +89,16 @@ Release report: TBD ### Fixed +- Fix `test_assign_agent_group_with_enrollment` ([#3956](https://github.com/wazuh/wazuh-qa/pull/3956)) \- (Tests) +- Fix `test_file_limit_delete_full` module ([#3990](https://github.com/wazuh/wazuh-qa/pull/3990)) \- (Tests) +- Fix test_agent_groups system test ([#3955](https://github.com/wazuh/wazuh-qa/pull/3964)) \- (Tests) +- Fix Solaris agent provision schema ([#3750](https://github.com/wazuh/wazuh-qa/issues/3744)) \- (Framework) +- Fix wazuh-db integration tests for agent-groups ([#3926](https://github.com/wazuh/wazuh-qa/pull/3926)) \- (Tests + Framework) +- Fix `test_set_agent_groups` ([#3920](https://github.com/wazuh/wazuh-qa/pull/3920)) \- (Tests) - Fix test_sync_agent_groups_get, replace hardcoded hash to a dinamically calculated one ([#3895](https://github.com/wazuh/wazuh-qa/pull/3895)) \- (Framework + Tests) +- Fix `test_agent_groups` ([#3889](https://github.com/wazuh/wazuh-qa/pull/3889)) \- (Tests + Framework) - Fix test_db_backup for Ubuntu OS ([#3802](https://github.com/wazuh/wazuh-qa/pull/3802)) \- (Tests) +- Fix Yara and VirusTotal E2E basic usage tests ([#3660](https://github.com/wazuh/wazuh-qa/pull/3660)) \- (Tests) - Fix commit option of the scan module for master case ([#3157](https://github.com/wazuh/wazuh-qa/pull/3157)) \- (Tests) - Fix Vulnerability Detector IT: test_validate_feed_content yaml cases had wrong extension. ([#3299](https://github.com/wazuh/wazuh-qa/pull/3299)) \- (Tests) - Fix Analysisd IT: test_syscollector_events failure on wait_for_analysisd_startup. ([#3110](https://github.com/wazuh/wazuh-qa/pull/3110)) \- (Tests) @@ -118,6 +118,11 @@ Release report: TBD - Remove all FIM Integration skipped tests ([#2927](https://github.com/wazuh/wazuh-qa/issues/2927)) \- (Framework + Tests) - VDT ITs: Remove Debian Stretch test support. ([#3172](https://github.com/wazuh/wazuh-qa/pull/3172)) \- (Tests) +## [4.3.10] - 16-11-2022 + +Wazuh commit: https://github.com/wazuh/wazuh/commit/89530f11c9e592cd2e551432209b0080f08ff8e5 \ +Release report: https://github.com/wazuh/wazuh/issues/15372 + ## [4.3.9] - 13-10-2022 Wazuh commit: https://github.com/wazuh/wazuh-qa/commit/8af0a5083bd69765f4d7878df9d3b785bb239723 \ @@ -141,7 +146,7 @@ Release report: https://github.com/wazuh/wazuh/issues/14827 Wazuh commit: https://github.com/wazuh/wazuh/commit/e2b514bef3d148acd4bcae1a1c7fa8783b82ca3a \ Release report: https://github.com/wazuh/wazuh/issues/14562 -## Added +### Added - Added IT test to verify Active Response works with overwritten rules. ([#2984](https://github.com/wazuh/wazuh-qa/pull/2984)) \- (Framework + Tests) - Add Integratord IT - new test_integratord suite ([#3125](https://github.com/wazuh/wazuh-qa/pull/3125)) \- (Framework + Tests) - Add system test to check synchronization status in the cluster ([#3180](https://github.com/wazuh/wazuh-qa/pull/3180)) \- (Framework + Tests) From ec10d7c89e99dddab984331ca782210fb3e63bfd Mon Sep 17 00:00:00 2001 From: Kevin Ledesma <44633633+QU3B1M@users.noreply.github.com> Date: Tue, 4 Apr 2023 15:30:16 +0200 Subject: [PATCH 12/34] feat(#4062): adapt integration tests for Office365 GCC support * feat(#4062): adapt integration tests for Office365 GCC support * docs(#4062): update changelog * style(#4062): fix yaml linting errors * fix(#4062): correct the config yaml indents * fix(#4062): add missing api_type value in case 8 --------- Co-authored-by: Bryce Shurts <89558443+S-Bryce@users.noreply.github.com> --- CHANGELOG.md | 1 + deps/wazuh_testing/wazuh_testing/office365.py | 6 +++ .../test_configuration/data/wazuh_conf.yaml | 51 ++++++++++--------- .../test_configuration/test_invalid.py | 31 ++++++++++- 4 files changed, 62 insertions(+), 27 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index af95813944..9e987097d4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,7 @@ Release report: TBD ### Changed +- Update `test_office365` to support the new tag `API_TYPE` ([#4065](https://github.com/wazuh/wazuh-qa/pull/4065)) \- (Framework + Tests) - Update `test_wazuh_db` & `test_enrollment` to support new column `status_code` and new value on the enrollment `payload`. ([#4021](https://github.com/wazuh/wazuh-qa/pull/4021)) \- (Tests) - Update FIM `test_audit` tests to new framework ([#3939](https://github.com/wazuh/wazuh-qa/pull/3939)) \- (Framework + Tests) - Update FIM test to new FIM DBSync process ([#2728](https://github.com/wazuh/wazuh-qa/pull/2728)) \- (Framework + Tests) diff --git a/deps/wazuh_testing/wazuh_testing/office365.py b/deps/wazuh_testing/wazuh_testing/office365.py index 9054650666..18fb3e0813 100644 --- a/deps/wazuh_testing/wazuh_testing/office365.py +++ b/deps/wazuh_testing/wazuh_testing/office365.py @@ -47,6 +47,12 @@ def callback_detect_client_secret_err(line): return None +def callback_detect_api_type_err(line): + if 'wm_office365_read(): ERROR: Empty content for tag \'api_type\' at module \'office365\'.' in line: + return line + return None + + def callback_detect_subscription_err(line): if 'wm_office365_read(): ERROR: Empty content for tag \'subscription\' at module \'office365\'.' in line: return line diff --git a/tests/integration/test_office365/test_configuration/data/wazuh_conf.yaml b/tests/integration/test_office365/test_configuration/data/wazuh_conf.yaml index 0baa4aa934..35443d2dcc 100644 --- a/tests/integration/test_office365/test_configuration/data/wazuh_conf.yaml +++ b/tests/integration/test_office365/test_configuration/data/wazuh_conf.yaml @@ -1,28 +1,29 @@ ---- - tags: - - offic365_integration + - offic365_integration apply_to_modules: - - test_invalid + - test_invalid sections: - - section: office365 - elements: - - enabled: - value: 'ENABLED' - - only_future_events: - value: 'ONLY_FUTURE_EVENTS' - - interval: - value: 'INTERVAL' - - curl_max_size: - value: 'CURL_MAX_SIZE' - - api_auth: - elements: - - tenant_id: - value: 'TENANT_ID' - - client_id: - value: 'CLIENT_ID' - - client_secret: - value: 'CLIENT_SECRET' - - subscriptions: - elements: - - subscription: - value: 'SUBSCRIPTION' + - section: office365 + elements: + - enabled: + value: ENABLED + - only_future_events: + value: ONLY_FUTURE_EVENTS + - interval: + value: INTERVAL + - curl_max_size: + value: CURL_MAX_SIZE + - api_auth: + elements: + - tenant_id: + value: TENANT_ID + - client_id: + value: CLIENT_ID + - client_secret: + value: CLIENT_SECRET + - api_type: + value: API_TYPE + - subscriptions: + elements: + - subscription: + value: SUBSCRIPTION diff --git a/tests/integration/test_office365/test_configuration/test_invalid.py b/tests/integration/test_office365/test_configuration/test_invalid.py index 6c196ff525..31f91895fe 100644 --- a/tests/integration/test_office365/test_configuration/test_invalid.py +++ b/tests/integration/test_office365/test_configuration/test_invalid.py @@ -51,7 +51,8 @@ from wazuh_testing import global_parameters from wazuh_testing.office365 import callback_detect_enabled_err, callback_detect_only_future_events_err, \ callback_detect_interval_err, callback_detect_curl_max_size_err, callback_detect_tenant_id_err, \ - callback_detect_client_id_err, callback_detect_client_secret_err, callback_detect_subscription_err + callback_detect_client_id_err, callback_detect_client_secret_err, callback_detect_subscription_err, \ + callback_detect_api_type_err from wazuh_testing.tools import LOG_FILE_PATH from wazuh_testing.tools.configuration import load_wazuh_configurations from wazuh_testing.tools.monitoring import FileMonitor @@ -85,6 +86,7 @@ 'TENANT_ID': 'test_tenant', 'CLIENT_ID': 'teat_client', 'CLIENT_SECRET': 'test_secret', + 'API_TYPE': 'commercial', 'SUBSCRIPTION': 'test_subscription' }, 'metadata': { @@ -101,6 +103,7 @@ 'TENANT_ID': 'test_tenant', 'CLIENT_ID': 'teat_client', 'CLIENT_SECRET': 'test_secret', + 'API_TYPE': 'commercial', 'SUBSCRIPTION': 'test_subscription' }, 'metadata': { @@ -117,6 +120,7 @@ 'TENANT_ID': 'test_tenant', 'CLIENT_ID': 'teat_client', 'CLIENT_SECRET': 'test_secret', + 'API_TYPE': 'commercial', 'SUBSCRIPTION': 'test_subscription' }, 'metadata': { @@ -133,6 +137,7 @@ 'TENANT_ID': 'test_tenant', 'CLIENT_ID': 'teat_client', 'CLIENT_SECRET': 'test_secret', + 'API_TYPE': 'commercial', 'SUBSCRIPTION': 'test_subscription' }, 'metadata': { @@ -149,6 +154,7 @@ 'TENANT_ID': '', 'CLIENT_ID': 'teat_client', 'CLIENT_SECRET': 'test_secret', + 'API_TYPE': 'commercial', 'SUBSCRIPTION': 'test_subscription' }, 'metadata': { @@ -165,6 +171,7 @@ 'TENANT_ID': 'test_tenant', 'CLIENT_ID': '', 'CLIENT_SECRET': 'test_secret', + 'API_TYPE': 'commercial', 'SUBSCRIPTION': 'test_subscription' }, 'metadata': { @@ -181,6 +188,7 @@ 'TENANT_ID': 'test_tenant', 'CLIENT_ID': 'teat_client', 'CLIENT_SECRET': '', + 'API_TYPE': 'commercial', 'SUBSCRIPTION': 'test_subscription' }, 'metadata': { @@ -197,11 +205,29 @@ 'TENANT_ID': 'test_tenant', 'CLIENT_ID': 'teat_client', 'CLIENT_SECRET': 'test_secret', + 'API_TYPE': 'commercial', 'SUBSCRIPTION': '' }, 'metadata': { 'tags': 'invalid_subscription' } + }, + # Case 9: Invalid api_type (version 4.5) + { + 'params': { + 'ENABLED': 'yes', + 'ONLY_FUTURE_EVENTS': 'yes', + 'INTERVAL': '1m', + 'CURL_MAX_SIZE': '1024', + 'TENANT_ID': 'test_tenant', + 'CLIENT_ID': 'teat_client', + 'CLIENT_SECRET': 'test_secret', + 'API_TYPE': '', + 'SUBSCRIPTION': 'test_subscription' + }, + 'metadata': { + 'tags': 'invalid_api_type' + } } ] params = [case['params'] for case in cases] @@ -220,7 +246,8 @@ 'invalid_tenant_id': callback_detect_tenant_id_err, 'invalid_client_id': callback_detect_client_id_err, 'invalid_client_secret': callback_detect_client_secret_err, - 'invalid_subscription': callback_detect_subscription_err + 'invalid_subscription': callback_detect_subscription_err, + 'invalid_api_type': callback_detect_api_type_err } From 43f57f1f1e4b320c3b1f3c4625825b2cd7213aa1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julia=20Mag=C3=A1n?= <80041853+juliamagan@users.noreply.github.com> Date: Wed, 12 Apr 2023 12:21:32 +0200 Subject: [PATCH 13/34] feat: update changelog for 4.4.1 tag (#4084) --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 87946aa351..bada6146f1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,11 @@ All notable changes to this project will be documented in this file. +## [4.4.1] - 12-04-2023 + +Wazuh commit: https://github.com/wazuh/wazuh/commit/63a0580562007c4ba9c117f4a232ce90160481ff \ +Release report: https://github.com/wazuh/wazuh/issues/16620 + ## [4.4.0] - 28-03-2023 Wazuh commit: https://github.com/wazuh/wazuh/commit/2477e9fa50bc1424e834ac8401ce2450a5978e75 \ From 21e912c7d78a5be7d91a3759d081fa0254768a05 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Wed, 12 Apr 2023 16:57:19 +0100 Subject: [PATCH 14/34] fix(#4079): fix unstable system tests * fix(#4079): test active response log format * fix(#4079): remove log monitor to avoid race condition * fix(#4079): internal option fixture call * fix(#4079): enrollment cluster log path typo * docs(#4070): include missing tests in README * feat(#4079): include marks to system tests * docs(#4070): update changelog * docs(#4079): restore deleted commentary * docs(#4079): move pr changes to fixed category --- CHANGELOG.md | 6 ++++++ tests/system/README.md | 3 +++ tests/system/pytest.ini | 1 + .../test_active_response_log_format.py | 5 +++-- tests/system/test_agent_auth/test_agent_auth.py | 2 ++ .../test_agent_groups/data/enrollment_group_messages.yaml | 2 +- .../test_agent_groups_new_cluster_node.py | 1 - .../test_assign_agent_group_with_enrollment.py | 7 ++----- .../test_agent_groups/test_assign_agent_to_a_group.py | 2 +- .../test_agent_groups/test_assign_groups_guess.py | 2 +- tests/system/test_enrollment/test_enrollment.py | 3 +++ tests/system/test_fim/test_files/test_files_cud.py | 2 ++ 12 files changed, 25 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bada6146f1..36374789ae 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ All notable changes to this project will be documented in this file. +## [4.4.2] - TBD + +### Fixed + +- Fix unstable system tests ([#4080](https://github.com/wazuh/wazuh-qa/pull/4080)) \- (Tests) + ## [4.4.1] - 12-04-2023 Wazuh commit: https://github.com/wazuh/wazuh/commit/63a0580562007c4ba9c117f4a232ce90160481ff \ diff --git a/tests/system/README.md b/tests/system/README.md index f6712bb511..746bbaed05 100644 --- a/tests/system/README.md +++ b/tests/system/README.md @@ -110,6 +110,9 @@ required an specific testing environment located in `wazuh-qa/tests/system/provi | Functionality | Required environment | |---------------------------------------------------------------------------|--------------------------------| | test_cluster/test_agent_enrollment | enrollment_cluster | +| test_agent_auth/test_agent_auth | basic_environment | +| test_enrollment/test_enrollment | basic_environment | +| test_files_cud/test_files_cud | one_manager_agent | | test_cluster/test_agent_info_sync | basic_cluster | | test_cluster/test_agent_key_polling | basic_cluster | | test_cluster/test_agent_files_deletion | basic_cluster | diff --git a/tests/system/pytest.ini b/tests/system/pytest.ini index d0c7187a0c..4781cb1cad 100644 --- a/tests/system/pytest.ini +++ b/tests/system/pytest.ini @@ -5,6 +5,7 @@ markers = server enrollment_cluster_env: Enrollment cluster environment system tests basic_cluster_env: Basic cluster environment system tests + basic_environment_env: Basic environment. One manager and one agent agentless_cluster_env: Agentless cluster environment system tests manager_agent_env: Manager agent environment system tests one_manager_agent_env: One manager agent environment system tests diff --git a/tests/system/test_active_response_log_format/test_active_response_log_format.py b/tests/system/test_active_response_log_format/test_active_response_log_format.py index b0988374ab..7f8cd3d4af 100644 --- a/tests/system/test_active_response_log_format/test_active_response_log_format.py +++ b/tests/system/test_active_response_log_format/test_active_response_log_format.py @@ -63,8 +63,8 @@ tmp_path = os.path.join(local_path, 'tmp') log_path = "/var/log/secure" ip = ".".join(str(randint(0, 255)) for _ in range(4)) -log_sample = f"""Dec 9 22:15:40 localhost sshd[5332]: Failed password for invalid - user BALROG from {ip} port 52620 '$token': `132`! ssh2\n\n""" +log_sample = f"Dec 9 22:15:40 localhost sshd[5332]: Failed password for invalid user BALROG from {ip} port 52620" + \ + "'$token': `132`! ssh2\n\n" sleep_time = 5 @@ -96,6 +96,7 @@ def test_active_response_log_format(wazuh_agent, message_file): # Clear the agents files that will be monitored. enviroment_files = [(wazuh_agent, os.path.join(WAZUH_LOGS_PATH, 'ossec.log')), (wazuh_agent, os.path.join(WAZUH_LOGS_PATH, 'active-responses.log'))] + clean_environment(host_manager, enviroment_files) # Add log message to agent monitored source diff --git a/tests/system/test_agent_auth/test_agent_auth.py b/tests/system/test_agent_auth/test_agent_auth.py index 8934273e44..dcc6c7ae8a 100644 --- a/tests/system/test_agent_auth/test_agent_auth.py +++ b/tests/system/test_agent_auth/test_agent_auth.py @@ -35,6 +35,8 @@ from wazuh_testing.tools.utils import format_ipv6_long +pytestmark = [pytest.mark.basic_environment_env] + # Hosts testinfra_hosts = ["wazuh-manager", "wazuh-agent1"] diff --git a/tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml b/tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml index 3e627d9848..3c7dc147ee 100644 --- a/tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml +++ b/tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml @@ -1,4 +1,4 @@ wazuh-master: - regex: .*Agent-groups send full.*Finished in.* - path: var/ossec/logs/cluster.log + path: /var/ossec/logs/cluster.log timeout: 60 diff --git a/tests/system/test_cluster/test_agent_groups/test_agent_groups_new_cluster_node.py b/tests/system/test_cluster/test_agent_groups/test_agent_groups_new_cluster_node.py index 3e963d5b69..df825986ef 100644 --- a/tests/system/test_cluster/test_agent_groups/test_agent_groups_new_cluster_node.py +++ b/tests/system/test_cluster/test_agent_groups/test_agent_groups_new_cluster_node.py @@ -60,7 +60,6 @@ test_infra_new_nodes = ["wazuh-worker3"] test_infra_agents = ["wazuh-agent1", "wazuh-agent2"] agent_groups = ["Group1", "Group2"] -pytestmark = [pytest.mark.cluster] inventory_path = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))), 'provisioning', 'four_manager_disconnected_node', 'inventory.yml') diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py index 1b1201ac78..20aa7d6c9f 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py @@ -65,7 +65,7 @@ tmp_path = os.path.join(local_path, 'tmp') data_path = os.path.join(local_path, 'data') messages_path = os.path.join(data_path, 'enrollment_group_messages.yaml') - +timeout_full_task_end = 60 # Variables id_group = 'group_test' @@ -109,10 +109,7 @@ def test_assign_agent_to_a_group(agent_target, clean_environment): restart_cluster(test_infra_agents, host_manager) - # Wait to Agent-groups send full task to end due to race condition - HostMonitor(inventory_path=inventory_path, - messages_path=messages_path, - tmp_path=tmp_path).run(update_position=True) + time.sleep(timeout_full_task_end) # Check that agent has client key file assert check_keys_file(test_infra_agents[0], host_manager), ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py index b234ba8743..ae6c6ed042 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py @@ -55,7 +55,7 @@ # Hosts test_infra_managers = ["wazuh-master", "wazuh-worker1", "wazuh-worker2"] test_infra_agents = ["wazuh-agent1"] -pytestmark = [pytest.mark.cluster] +pytestmark = [pytest.mark.cluster, pytest.mark.enrollment_cluster_env] inventory_path = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))), 'provisioning', 'enrollment_cluster', 'inventory.yml') diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py b/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py index 6d5ccd7b7a..17e17066b7 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py @@ -95,7 +95,7 @@ def modify_local_internal_options(status_guess_agent_group): backup_local_internal_options = host_manager.get_file_content(test_infra_managers[0], WAZUH_LOCAL_INTERNAL_OPTIONS) # Add local internal options - host_manager.configure_internal_options(local_internal_options) + host_manager.configure_local_internal_options(local_internal_options) yield diff --git a/tests/system/test_enrollment/test_enrollment.py b/tests/system/test_enrollment/test_enrollment.py index 7f2df2d925..420b4fdac3 100644 --- a/tests/system/test_enrollment/test_enrollment.py +++ b/tests/system/test_enrollment/test_enrollment.py @@ -39,9 +39,12 @@ from wazuh_testing.tools.utils import format_ipv6_long +pytestmark = [pytest.mark.basic_environment_env] + # Hosts testinfra_hosts = ['wazuh-manager', 'wazuh-agent1'] + inventory_path = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'provisioning', 'basic_environment', 'inventory.yml') host_manager = HostManager(inventory_path) diff --git a/tests/system/test_fim/test_files/test_files_cud.py b/tests/system/test_fim/test_files/test_files_cud.py index 0d45911f8a..9a483887b9 100644 --- a/tests/system/test_fim/test_files/test_files_cud.py +++ b/tests/system/test_fim/test_files/test_files_cud.py @@ -49,6 +49,8 @@ from wazuh_testing.fim import create_folder_file, wait_for_fim_scan_end +pytestmark = [pytest.mark.one_manager_agent_env] + # Hosts testinfra_hosts = ["wazuh-manager", "wazuh-agent1"] From 5e4e21abaf7a3061ba97bcdebc8ba4dfbdcbf4d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Thu, 13 Apr 2023 09:40:37 +0100 Subject: [PATCH 15/34] fix(#3942): fix agentd IT for python310 * fix(#3942): include simulator teardown * style(#3943): pep8 * docs(#3942): include 3973 changelog * docs(#3942): move pr changes to fixed category * refactor(#3942): remove unnecessary scopes * docs(#3942): change changelog pr entry * docs(#3942): move change to 4.4.2 * docs(#3942): include teardown documentation --- CHANGELOG.md | 1 + .../test_agentd_parametrized_reconnections.py | 8 ++++- .../test_agentd/test_agentd_reconnection.py | 32 ++++++++++++++++--- .../test_agentd/test_agentd_state.py | 2 +- 4 files changed, 36 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 36374789ae..15d3e8b3a3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ All notable changes to this project will be documented in this file. ### Fixed +- Fix agentd IT for python3.10 AMI ([#3973](https://github.com/wazuh/wazuh-qa/pull/3973)) \- (Tests) - Fix unstable system tests ([#4080](https://github.com/wazuh/wazuh-qa/pull/4080)) \- (Tests) ## [4.4.1] - 12-04-2023 diff --git a/tests/integration/test_agentd/test_agentd_parametrized_reconnections.py b/tests/integration/test_agentd/test_agentd_parametrized_reconnections.py index 1a0799fc42..71a2e53e72 100644 --- a/tests/integration/test_agentd/test_agentd_parametrized_reconnections.py +++ b/tests/integration/test_agentd/test_agentd_parametrized_reconnections.py @@ -103,7 +103,10 @@ remoted_server = None +@pytest.fixture def teardown(): + yield + global remoted_server if remoted_server is not None: remoted_server.stop() @@ -308,7 +311,7 @@ def parse_time_from_log_line(log_line): def test_agentd_parametrized_reconnections(configure_authd_server, start_authd, stop_agent, set_keys, - configure_environment, get_configuration): + configure_environment, get_configuration, teardown): ''' description: Check how the agent behaves when there are delays between connection attempts to the server. For this purpose, different values for @@ -337,6 +340,9 @@ def test_agentd_parametrized_reconnections(configure_authd_server, start_authd, - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that when the 'wazuh-agentd' daemon initializes, it connects to diff --git a/tests/integration/test_agentd/test_agentd_reconnection.py b/tests/integration/test_agentd/test_agentd_reconnection.py index f1baa75029..5a36b1c4a0 100644 --- a/tests/integration/test_agentd/test_agentd_reconnection.py +++ b/tests/integration/test_agentd/test_agentd_reconnection.py @@ -100,10 +100,13 @@ authd_server = AuthdSimulator(params[0]['SERVER_ADDRESS'], key_path=SERVER_KEY_PATH, cert_path=SERVER_CERT_PATH) +global remoted_server remoted_server = None +@pytest.fixture def teardown(): + yield global remoted_server if remoted_server is not None: remoted_server.stop() @@ -225,7 +228,8 @@ def search_error_messages(): """ -def test_agentd_reconection_enrollment_with_keys(configure_authd_server, configure_environment, get_configuration): +def test_agentd_reconection_enrollment_with_keys(configure_authd_server, configure_environment, + get_configuration, teardown): ''' description: Check how the agent behaves when losing communication with the 'wazuh-remoted' daemon and a new enrollment is sent to @@ -246,6 +250,9 @@ def test_agentd_reconection_enrollment_with_keys(configure_authd_server, configu - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that the agent enrollment is successful. @@ -310,7 +317,8 @@ def test_agentd_reconection_enrollment_with_keys(configure_authd_server, configu """ -def test_agentd_reconection_enrollment_no_keys_file(configure_authd_server, configure_environment, get_configuration): +def test_agentd_reconection_enrollment_no_keys_file(configure_authd_server, configure_environment, get_configuration, + teardown): ''' description: Check how the agent behaves when losing communication with the 'wazuh-remoted' daemon and a new enrollment is sent to @@ -331,6 +339,9 @@ def test_agentd_reconection_enrollment_no_keys_file(configure_authd_server, conf - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that the agent enrollment is successful. @@ -398,7 +409,8 @@ def test_agentd_reconection_enrollment_no_keys_file(configure_authd_server, conf """ -def test_agentd_reconection_enrollment_no_keys(configure_authd_server, configure_environment, get_configuration): +def test_agentd_reconection_enrollment_no_keys(configure_authd_server, configure_environment, get_configuration, + teardown): ''' description: Check how the agent behaves when losing communication with the 'wazuh-remoted' daemon and a new enrollment is sent to @@ -419,6 +431,9 @@ def test_agentd_reconection_enrollment_no_keys(configure_authd_server, configure - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that the agent enrollment is successful. @@ -487,7 +502,7 @@ def test_agentd_reconection_enrollment_no_keys(configure_authd_server, configure """ -def test_agentd_initial_enrollment_retries(configure_authd_server, configure_environment, get_configuration): +def test_agentd_initial_enrollment_retries(configure_authd_server, configure_environment, get_configuration, teardown): ''' description: Check how the agent behaves when it makes multiple enrollment attempts before getting its key. For this, the agent starts without keys and @@ -508,6 +523,9 @@ def test_agentd_initial_enrollment_retries(configure_authd_server, configure_env - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that the agent enrollment is successful. @@ -581,7 +599,8 @@ def test_agentd_initial_enrollment_retries(configure_authd_server, configure_env """ -def test_agentd_connection_retries_pre_enrollment(configure_authd_server, configure_environment, get_configuration): +def test_agentd_connection_retries_pre_enrollment(configure_authd_server, configure_environment, get_configuration, + teardown): ''' description: Check how the agent behaves when the 'wazuh-remoted' daemon is not available and performs multiple connection attempts to it. For this, the agent starts @@ -602,6 +621,9 @@ def test_agentd_connection_retries_pre_enrollment(configure_authd_server, config - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that the agent enrollment is successful. diff --git a/tests/integration/test_agentd/test_agentd_state.py b/tests/integration/test_agentd/test_agentd_state.py index cf6248ba29..836ecde9d8 100644 --- a/tests/integration/test_agentd/test_agentd_state.py +++ b/tests/integration/test_agentd/test_agentd_state.py @@ -121,7 +121,7 @@ def add_custom_key(): @pytest.mark.parametrize('test_case', [test_case['test_case'] for test_case in test_cases], ids=[test_case['name'] for test_case in test_cases]) -def test_agentd_state(configure_environment, test_case: list): +def test_agentd_state(configure_environment, test_case): ''' description: Check that the statistics file 'wazuh-agentd.state' is created automatically and verify that the content of its fields is correct. From 9b597ea2d379006e8f4a82ad0c0917125c42aad1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julia=20Mag=C3=A1n?= <80041853+juliamagan@users.noreply.github.com> Date: Thu, 13 Apr 2023 16:42:03 +0200 Subject: [PATCH 16/34] feat(#3912): add tests for groups deletion * feat(#3912): add function to get group id * feat(#3912): add test for group deletion * feat(#3912): add test cases * fix(#3912): fix linter errors * feat(#3912): update changelog * fix(#3912): fix typo * docs(#3912): improve description * fix(#3912): change import * docs(#3912): improve documentation * fix(#3912): delete created group during tear down * docs(#3912): add documentation * refactor(#3912)!: change delete function and test cases * refactor(#3912): change affected tests * feat(#3912): store binary path * docs(#3912): add function documentation * fix(#3912): update changelog --- CHANGELOG.md | 4 + .../wazuh_testing/tools/__init__.py | 1 + tests/system/__init__.py | 51 ++++++- .../data/cases_remove_group.yaml | 39 ++++++ .../data/remove_group_messages.yaml | 4 + ...test_assign_agent_group_with_enrollment.py | 4 +- ...t_assign_agent_never_connected_to_group.py | 4 +- .../test_assign_agent_to_a_group.py | 4 +- .../test_assign_agent_to_a_group_api.py | 4 +- .../test_assign_agent_to_a_group_by_tool.py | 4 +- .../test_assign_groups_guess.py | 6 +- .../test_agent_groups/test_remove_group.py | 132 ++++++++++++++++++ 12 files changed, 240 insertions(+), 17 deletions(-) create mode 100644 tests/system/test_cluster/test_agent_groups/data/cases_remove_group.yaml create mode 100644 tests/system/test_cluster/test_agent_groups/data/remove_group_messages.yaml create mode 100644 tests/system/test_cluster/test_agent_groups/test_remove_group.py diff --git a/CHANGELOG.md b/CHANGELOG.md index 15d3e8b3a3..00acf3a907 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file. ## [4.4.2] - TBD +### Added + +- Add system tests for groups deletion ([#4057](https://github.com/wazuh/wazuh-qa/pull/4057)) \- (Tests) + ### Fixed - Fix agentd IT for python3.10 AMI ([#3973](https://github.com/wazuh/wazuh-qa/pull/3973)) \- (Tests) diff --git a/deps/wazuh_testing/wazuh_testing/tools/__init__.py b/deps/wazuh_testing/wazuh_testing/tools/__init__.py index 60fa272e99..9cc68a2f3a 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/__init__.py +++ b/deps/wazuh_testing/wazuh_testing/tools/__init__.py @@ -72,6 +72,7 @@ AGENT_AUTH_BINARY_PATH = os.path.join(WAZUH_PATH, 'bin', 'agent-auth') ANALYSISD_BINARY_PATH = os.path.join(WAZUH_PATH, 'bin', 'wazuh-analysisd') ACTIVE_RESPONSE_BINARY_PATH = os.path.join(WAZUH_PATH, 'active-response', 'bin') + AGENT_GROUPS_BINARY_PATH = os.path.join(WAZUH_PATH, 'bin', 'agent_groups') if sys.platform == 'sunos5': HOSTS_FILE_PATH = os.path.join('/', 'etc', 'inet', 'hosts') diff --git a/tests/system/__init__.py b/tests/system/__init__.py index 4534a788a6..0c88cfd250 100644 --- a/tests/system/__init__.py +++ b/tests/system/__init__.py @@ -3,8 +3,9 @@ # This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 import os +import json -from wazuh_testing.tools import WAZUH_PATH, LOG_FILE_PATH, CLUSTER_LOGS_PATH +from wazuh_testing.tools import WAZUH_PATH, LOG_FILE_PATH, CLUSTER_LOGS_PATH, AGENT_GROUPS_BINARY_PATH # Agent Variables AGENT_STATUS_ACTIVE = 'active' @@ -83,9 +84,24 @@ def assign_agent_to_new_group(host, id_group, id_agent, host_manager): host_manager.run_command(host, f"/var/ossec/bin/agent_groups -q -a -i {id_agent} -g {id_group}") -def delete_group_of_agents(host, id_group, host_manager): - # Delete group - host_manager.run_command(host, f"/var/ossec/bin/agent_groups -q -r -g {id_group}") +def delete_agent_group(host, id_group, host_manager, method='tool'): + """Function to delete a group. + Args: + host (str): Host name where the query will be executed. + id_group (str): Name of the group from which the id will be obtained. + host_manager (obj): Instance of HostManager. + method (str): Method to be used to delete the group. Default: tool. + """ + if method == 'tool': + host_manager.run_command(host, f"{AGENT_GROUPS_BINARY_PATH} -q -r -g {id_group}") + elif method == 'api': + master_token = host_manager.get_api_token(host) + host_manager.make_api_call(host=host, method='DELETE', token=master_token, + endpoint=f"/groups?groups_list={id_group}") + elif method == 'folder': + host_manager.run_command(host, f"rm -rf /var/ossec/etc/shared/{id_group}") + else: + raise ValueError(f"{method} is not a valid method, it should be tool, api or folder") def check_agent_groups(agent_id, group_to_check, hosts_list, host_manager): @@ -132,6 +148,33 @@ def change_agent_group_with_wdb(agent_id, new_group, host, host_manager): def execute_wdb_query(query, host, host_manager): + """Function to execute wdb query. + Args: + query (str): Query to execute + host (str): Host name where the query will be executed. + host_manager (obj): Instance of HostManager. + Returns: + response (str): Obtained response. + """ response = host_manager.run_command(host, f"python3 {WAZUH_PATH}/bin/wdb-query.py {query}") return response + + +def get_group_id(group_name, host, host_manager): + """Function to obtain the group ID. + Args: + group_name (str): Name of the group from which the id will be obtained. + host (str): Host name where the query will be executed. + host_manager (obj): Instance of HostManager. + Returns: + group_id (int): Obtained group ID. + """ + group_table_command = 'sql select * from `group`;' + query = f"global '{group_table_command}'" + group_table = execute_wdb_query(query, host, host_manager) + for group_data in json.loads(group_table): + if group_data['name'] == group_name: + group_id = group_data['id'] + + return group_id diff --git a/tests/system/test_cluster/test_agent_groups/data/cases_remove_group.yaml b/tests/system/test_cluster/test_agent_groups/data/cases_remove_group.yaml new file mode 100644 index 0000000000..36568b1e43 --- /dev/null +++ b/tests/system/test_cluster/test_agent_groups/data/cases_remove_group.yaml @@ -0,0 +1,39 @@ +- name: api + description: remove group with api + configuration_parameters: null + metadata: + method: | + delete_agent_group(test_infra_managers[0], group, host_manager, 'api') + deleted: true + +- name: tool + description: remove group with agent_groups + configuration_parameters: null + metadata: + method: | + delete_agent_group(test_infra_managers[0], group, host_manager, 'tool') + deleted: true + +- name: master_folder + description: remove group by removing its folder in master node + configuration_parameters: null + metadata: + method: | + delete_agent_group(test_infra_managers[0], group, host_manager, 'folder') + deleted: true + +- name: worker1_folder + description: remove group by removing its folder in worker node + configuration_parameters: null + metadata: + method: | + delete_agent_group(test_infra_managers[1], group, host_manager, 'folder') + deleted: false + +- name: worker2_folder + description: remove group by removing its folder in worker node + configuration_parameters: null + metadata: + method: | + delete_agent_group(test_infra_managers[2], group, host_manager, 'folder') + deleted: false diff --git a/tests/system/test_cluster/test_agent_groups/data/remove_group_messages.yaml b/tests/system/test_cluster/test_agent_groups/data/remove_group_messages.yaml new file mode 100644 index 0000000000..44b6788c23 --- /dev/null +++ b/tests/system/test_cluster/test_agent_groups/data/remove_group_messages.yaml @@ -0,0 +1,4 @@ +wazuh-master: + - regex: .*Agent-groups send full.* Finished.* + path: var/ossec/logs/cluster.log + timeout: 60 diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py index 20aa7d6c9f..5531ea9452 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py @@ -45,7 +45,7 @@ import time import pytest -from system import (ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, restart_cluster, check_keys_file, delete_group_of_agents, +from system import (ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, restart_cluster, check_keys_file, delete_agent_group, check_agent_groups_db) from wazuh_testing.tools.monitoring import HostMonitor from wazuh_testing.tools.system import HostManager @@ -121,4 +121,4 @@ def test_assign_agent_to_a_group(agent_target, clean_environment): finally: # Delete group of agent - delete_group_of_agents(test_infra_managers[0], id_group, host_manager) + delete_agent_group(test_infra_managers[0], id_group, host_manager) diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_never_connected_to_group.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_never_connected_to_group.py index a2db055120..6783b023d8 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_never_connected_to_group.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_never_connected_to_group.py @@ -44,7 +44,7 @@ import pytest from system.test_cluster.test_agent_groups.common import register_agent -from system import (check_agent_groups, check_agent_status, check_keys_file, delete_group_of_agents, +from system import (check_agent_groups, check_agent_status, check_keys_file, delete_agent_group, AGENT_STATUS_NEVER_CONNECTED, ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND) from wazuh_testing.tools.system import HostManager @@ -105,4 +105,4 @@ def test_assign_agent_to_a_group(agent_target, clean_environment): finally: # Delete group of agent - delete_group_of_agents('wazuh-master', id_group, host_manager) + delete_agent_group('wazuh-master', id_group, host_manager) diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py index ae6c6ed042..27a7806282 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py @@ -47,7 +47,7 @@ from system.test_cluster.test_agent_groups.common import register_agent from system import (AGENT_NO_GROUPS, AGENT_STATUS_ACTIVE, AGENT_STATUS_DISCONNECTED, check_agent_groups, check_agent_status, restart_cluster, check_keys_file, assign_agent_to_new_group, - delete_group_of_agents, ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, create_new_agent_group) + delete_agent_group, ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, create_new_agent_group) from wazuh_testing.modules import WAZUH_SERVICE_PREFIX, WAZUH_SERVICES_STOPPED from wazuh_testing.tools.system import HostManager @@ -128,4 +128,4 @@ def test_assign_agent_to_a_group(agent_target, initial_status, clean_environment finally: # Delete group of agent - delete_group_of_agents('wazuh-master', test_group, host_manager) + delete_agent_group('wazuh-master', test_group, host_manager) diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_api.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_api.py index 5f0b842bcd..0567cb03fe 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_api.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_api.py @@ -46,7 +46,7 @@ from system.test_cluster.test_agent_groups.common import register_agent from system import (AGENT_NO_GROUPS, AGENT_STATUS_ACTIVE, AGENT_STATUS_DISCONNECTED, ERR_MSG_FAILED_TO_SET_AGENT_GROUP, ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, check_agent_groups, check_agent_status, restart_cluster, - check_keys_file, delete_group_of_agents, create_new_agent_group) + check_keys_file, delete_agent_group, create_new_agent_group) from wazuh_testing.tools.system import HostManager @@ -131,4 +131,4 @@ def test_assign_agent_to_a_group(agent_target, initial_status, clean_environment # Delete group of agent finally: - delete_group_of_agents(test_infra_managers[0], test_group, host_manager) + delete_agent_group(test_infra_managers[0], test_group, host_manager) diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_by_tool.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_by_tool.py index 3cc3c5cc14..6fcf8768c8 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_by_tool.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_by_tool.py @@ -48,7 +48,7 @@ from system.test_cluster.test_agent_groups.common import register_agent from system import (check_agent_groups, check_agent_status, check_keys_file, create_new_agent_group, - delete_group_of_agents, assign_agent_to_new_group, AGENT_NO_GROUPS, AGENT_STATUS_NEVER_CONNECTED) + delete_agent_group, assign_agent_to_new_group, AGENT_NO_GROUPS, AGENT_STATUS_NEVER_CONNECTED) from wazuh_testing.tools.system import HostManager @@ -117,4 +117,4 @@ def test_assign_agent_to_a_group_by_tool(agent_target, clean_environment): finally: # Delete group of agent - delete_group_of_agents(test_infra_managers[0], group_id, host_manager) + delete_agent_group(test_infra_managers[0], group_id, host_manager) diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py b/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py index 17e17066b7..6d56111ad8 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py @@ -46,7 +46,7 @@ from system.test_cluster.test_agent_groups.common import register_agent from system import (ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, check_agent_groups, check_keys_file, - create_new_agent_group, delete_group_of_agents, remove_cluster_agents, + create_new_agent_group, delete_agent_group, remove_cluster_agents, assign_agent_to_new_group, restart_cluster) from wazuh_testing.tools.system import HostManager from wazuh_testing.tools.file import replace_regex_in_file @@ -189,7 +189,7 @@ def test_guess_single_group(target_node, status_guess_agent_group, clean_environ finally: # Delete group of agent - delete_group_of_agents(test_infra_managers[0], group_id, host_manager) + delete_agent_group(test_infra_managers[0], group_id, host_manager) replace_regex_in_file([agent_id, expected_group], ['AGENT_ID', 'GROUP_ID'], messages_path) @@ -285,5 +285,5 @@ def test_guess_multigroups(n_agents, target_node, status_guess_agent_group, clea finally: # Delete group of agent - delete_group_of_agents(test_infra_managers[0], group_id, host_manager) + delete_agent_group(test_infra_managers[0], group_id, host_manager) replace_regex_in_file([agent1_id, expected_group], ['AGENT_ID', 'GROUP_ID'], messages_path) diff --git a/tests/system/test_cluster/test_agent_groups/test_remove_group.py b/tests/system/test_cluster/test_agent_groups/test_remove_group.py new file mode 100644 index 0000000000..ad140ded38 --- /dev/null +++ b/tests/system/test_cluster/test_agent_groups/test_remove_group.py @@ -0,0 +1,132 @@ +import os +import pytest +from time import sleep + +from system import (ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, check_agent_groups, check_keys_file, + create_new_agent_group, assign_agent_to_new_group, restart_cluster, execute_wdb_query, get_group_id, + delete_agent_group) +from wazuh_testing import T_10 +from system.test_cluster.test_agent_groups.common import register_agent +from wazuh_testing.tools.configuration import get_test_cases_data +from wazuh_testing.tools.monitoring import HostMonitor +from wazuh_testing.tools.system import HostManager + +pytestmark = [pytest.mark.cluster, pytest.mark.enrollment_cluster_env] + +# Hosts +test_infra_managers = ['wazuh-master', 'wazuh-worker1', 'wazuh-worker2'] +test_infra_agents = ['wazuh-agent1', 'wazuh-agent2'] + +inventory_path = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))), + 'provisioning', 'enrollment_cluster', 'inventory.yml') +data_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'data') +host_manager = HostManager(inventory_path) +local_path = os.path.dirname(os.path.abspath(__file__)) +tmp_path = os.path.join(local_path, 'tmp') +t1_cases_path = os.path.join(data_path, 'cases_remove_group.yaml') +messages_path = os.path.join(data_path, 'remove_group_messages.yaml') + +# Variables +t1_configuration_parameters, t1_configuration_metadata, t1_case_ids = get_test_cases_data(t1_cases_path) +queries = ['sql select `group` from agent;', 'sql select name from `group`;', 'sql select id_group from belongs;'] + + +# Fixtures +@pytest.fixture() +def pre_configured_groups(target_node, group): + """Fixture to create a group and assign an agent during the setup. + Args: + target_node (str): Name of the host where the agent will register. + group (str): Group name. + """ + # Create group + if group != 'default': + create_new_agent_group(test_infra_managers[0], group, host_manager) + + # Register agent with agent-auth + agent_ip, agent_id, agent_name, manager_ip = register_agent(test_infra_agents[0], target_node, + host_manager) + + # Restart agent + restart_cluster([test_infra_agents[0]], host_manager) + + # Check that agent has client key file + assert check_keys_file(test_infra_agents[0], host_manager), ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND + + # Assign agent to group + if group != 'default': + assign_agent_to_new_group(test_infra_managers[0], group, agent_id, host_manager) + + # Check that agent has group assigned on every node + check_agent_groups(agent_id, group, test_infra_managers, host_manager) + + yield + + if group != 'default': + delete_agent_group(test_infra_managers[0], group, host_manager) + + +# Tests +@pytest.mark.parametrize('metadata', t1_configuration_metadata, ids=t1_case_ids) +@pytest.mark.parametrize('group', ['group_test']) +@pytest.mark.parametrize('target_node', ['wazuh-master', 'wazuh-worker1']) +def test_remove_group(metadata, group, target_node, pre_configured_groups, clean_environment): + ''' + description: Check that a group is completely deleted from all nodes when using different deletion methods, with the + exception of cases where the group folder is deleted on a worker node. + wazuh_min_version: 4.4.0 + parameters: + - metadata: + type: dict + brief: Get metadata from the module. + - group: + type: string + brief: Group name. + - target_node: + type: string + brief: Name of the host where the agent will register. + - pre_configured_groups: + type: fixture + brief: Create group, register and assign agent during the setup. + - clean_environment: + type: fixture + brief: Reset the wazuh log files at the start of the test. Remove all registered agents from master. + assertions: + - Verify [Agent-groups send full] task finished when the group folder is removed in a worker node. + - Verify group name is present in agent table when the group folder is removed in a worker node. + - Verify group id is present in agent table when the group folder is removed in a worker node. + - Verify group name is not present in agent table when group is deleted. + - Verify group id is not present in agent table when group is deleted. + ''' + # Get group IDs + group_ids = {} + for manager in test_infra_managers: + group_ids[manager] = str(get_group_id(group, manager, host_manager)) + + # Delete group + exec(metadata['method']) + sleep(T_10) + + if not metadata['deleted']: + HostMonitor(inventory_path=inventory_path, + messages_path=messages_path, + tmp_path=tmp_path).run(update_position=True) + + for manager in test_infra_managers: + group_ids[manager] = str(get_group_id(group, manager, host_manager)) + + # Check group is deleted or not if expected in agent table in every node + for query in queries: + for manager in test_infra_managers: + global_query = f"global '{query}'" + response = execute_wdb_query(global_query, manager, host_manager) + if metadata['deleted']: + if 'id_group' in query: + assert group_ids[manager] not in response, f"Group not deleted correctly in {manager}" + else: + assert group not in response, f"Group not deleted correctly in {manager}" + else: + if 'id_group' in query: + assert group_ids[manager] in response, f"Group deleted in {manager}" + else: + assert group in response, f"Group deleted in {manager}" From 1656ad8490517f6a1728ff8ce10cdcbfc2c924f3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julia=20Mag=C3=A1n?= <80041853+juliamagan@users.noreply.github.com> Date: Fri, 14 Apr 2023 11:50:57 +0200 Subject: [PATCH 17/34] feat(#4089): bump version to 4.4.2 * feat(#4089): bump version to 4.4.2 * refactor(#4089): change revision --- version.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/version.json b/version.json index 90990b71a5..5a3c804483 100644 --- a/version.json +++ b/version.json @@ -1,4 +1,4 @@ { - "version": "4.4.0", - "revision": "1" + "version": "4.4.2", + "revision": "40407" } From f78f157b2f0f4f9ff14eacf0112859ee291d1db3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julia=20Mag=C3=A1n?= <80041853+juliamagan@users.noreply.github.com> Date: Fri, 14 Apr 2023 12:17:34 +0200 Subject: [PATCH 18/34] merge(#4089)!: merge 4.4 into 4.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(3862): fix test_assign_agent_group_with_enrollment * fix(#3862): delete default group check * feat(#3862): update changelog * refactor(#3862): add expected logs * fix(#4047): fix duplicated slash in API endpoint (#4048) * refactor: update changelog * refactor: bump version to 4.3.10 * refactor: update changelog --------- Co-authored-by: jmv74211 * feat: update changelog for 4.4.1 tag (#4084) * fix(#4079): fix unstable system tests * fix(#4079): test active response log format * fix(#4079): remove log monitor to avoid race condition * fix(#4079): internal option fixture call * fix(#4079): enrollment cluster log path typo * docs(#4070): include missing tests in README * feat(#4079): include marks to system tests * docs(#4070): update changelog * docs(#4079): restore deleted commentary * docs(#4079): move pr changes to fixed category * fix(#3942): fix agentd IT for python310 * fix(#3942): include simulator teardown * style(#3943): pep8 * docs(#3942): include 3973 changelog * docs(#3942): move pr changes to fixed category * refactor(#3942): remove unnecessary scopes * docs(#3942): change changelog pr entry * docs(#3942): move change to 4.4.2 * docs(#3942): include teardown documentation * feat(#3912): add tests for groups deletion * feat(#3912): add function to get group id * feat(#3912): add test for group deletion * feat(#3912): add test cases * fix(#3912): fix linter errors * feat(#3912): update changelog * fix(#3912): fix typo * docs(#3912): improve description * fix(#3912): change import * docs(#3912): improve documentation * fix(#3912): delete created group during tear down * docs(#3912): add documentation * refactor(#3912)!: change delete function and test cases * refactor(#3912): change affected tests * feat(#3912): store binary path * docs(#3912): add function documentation * fix(#3912): update changelog * feat(#4089): bump version to 4.4.2 * feat(#4089): bump version to 4.4.2 * refactor(#4089): change revision --------- Co-authored-by: José Luis López Sánchez Co-authored-by: jmv74211 Co-authored-by: Víctor Rebollo Pérez --- CHANGELOG.md | 44 ++++-- .../wazuh_testing/tools/__init__.py | 1 + .../test_agentd_parametrized_reconnections.py | 8 +- .../test_agentd/test_agentd_reconnection.py | 32 ++++- .../test_agentd/test_agentd_state.py | 2 +- tests/integration/test_api/conftest.py | 8 +- .../test_response_postprocessing.py | 2 +- tests/system/README.md | 3 + tests/system/__init__.py | 51 ++++++- tests/system/pytest.ini | 1 + .../test_active_response_log_format.py | 5 +- .../system/test_agent_auth/test_agent_auth.py | 2 + .../data/cases_remove_group.yaml | 39 ++++++ .../data/enrollment_group_messages.yaml | 4 + .../data/remove_group_messages.yaml | 4 + .../test_agent_groups_new_cluster_node.py | 1 - ...test_assign_agent_group_with_enrollment.py | 46 ++---- ...t_assign_agent_never_connected_to_group.py | 4 +- .../test_assign_agent_to_a_group.py | 6 +- .../test_assign_agent_to_a_group_api.py | 4 +- .../test_assign_agent_to_a_group_by_tool.py | 4 +- .../test_assign_groups_guess.py | 8 +- .../test_agent_groups/test_remove_group.py | 132 ++++++++++++++++++ .../system/test_enrollment/test_enrollment.py | 3 + .../test_fim/test_files/test_files_cud.py | 2 + version.json | 2 +- 26 files changed, 343 insertions(+), 75 deletions(-) create mode 100644 tests/system/test_cluster/test_agent_groups/data/cases_remove_group.yaml create mode 100644 tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml create mode 100644 tests/system/test_cluster/test_agent_groups/data/remove_group_messages.yaml create mode 100644 tests/system/test_cluster/test_agent_groups/test_remove_group.py diff --git a/CHANGELOG.md b/CHANGELOG.md index 9e987097d4..c2ede1e2b5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -39,18 +39,32 @@ Release report: TBD - Fix an error in the cluster performance tests related to CSV parser ([#2999](https://github.com/wazuh/wazuh-qa/pull/2999)) \- (Framework + Tests) - Fix bug in the framework on migration tool ([#2999](https://github.com/wazuh/wazuh-qa/pull/4027)) \- (Framework) +## [4.4.2] - Development (unreleased) -## [4.4.0] - Development (unreleased) +### Added -Wazuh commit: TBD \ -Release report: TBD +- Add system tests for groups deletion ([#4057](https://github.com/wazuh/wazuh-qa/pull/4057)) \- (Tests) + +### Fixed + +- Fix agentd IT for python3.10 AMI ([#3973](https://github.com/wazuh/wazuh-qa/pull/3973)) \- (Tests) +- Fix unstable system tests ([#4080](https://github.com/wazuh/wazuh-qa/pull/4080)) \- (Tests) + +## [4.4.1] - 12-04-2023 + +Wazuh commit: https://github.com/wazuh/wazuh/commit/63a0580562007c4ba9c117f4a232ce90160481ff \ +Release report: https://github.com/wazuh/wazuh/issues/16620 + +## [4.4.0] - 28-03-2023 + +Wazuh commit: https://github.com/wazuh/wazuh/commit/2477e9fa50bc1424e834ac8401ce2450a5978e75 \ +Release report: https://github.com/wazuh/wazuh/issues/15504 ### Added - Add new integration test for `authd` to validate error when `authd.pass` is empty ([#3721](https://github.com/wazuh/wazuh-qa/pull/3721)) \- (Framework + Tests) - Add new test to check missing fields in `cpe_helper.json` file ([#3766](https://github.com/wazuh/wazuh-qa/pull/3766)) \- (Framework + Tests) - Add multigroups tests cases for `test_assign_groups_guess` ([#3979](https://github.com/wazuh/wazuh-qa/pull/3979)) \- (Tests) -- Fix test_agent_groups system test ([#3955](https://github.com/wazuh/wazuh-qa/pull/3964)) \- (Tests) - Add new group_hash case and update the `without condition` case output in `wazuh_db/sync_agent_groups_get` ([#3959](https://github.com/wazuh/wazuh-qa/pull/3959)) \- (Tests) - Add markers for each system test environment ([#3961](https://github.com/wazuh/wazuh-qa/pull/3961)) \- (Framework + Tests) - Adapt binary performance module to wazuh-cluster script renaming ([#3944](https://github.com/wazuh/wazuh-qa/pull/3944)) \- (Framework) @@ -62,7 +76,6 @@ Release report: TBD - Add new test to check vulnerable packages with triaged null([#3587](https://github.com/wazuh/wazuh-qa/pull/3587)) \- (Framework + Tests) - Add new tests analysid handling of invalid/empty rule signature IDs ([#3649](https://github.com/wazuh/wazuh-qa/pull/3649)) \- (Framework + Tests) - Add integration test to check agent database version ([#3768](https://github.com/wazuh/wazuh-qa/pull/3768)) \- (Tests) -- Fix Yara and VirusTotal E2E basic usage tests ([#3660](https://github.com/wazuh/wazuh-qa/pull/3660)) - Add new test to check if syslog message are parsed correctrly in the `archives.json` file ([#3609](https://github.com/wazuh/wazuh-qa/pull/3609)) \- (Framework + Tests) - Add new logging tests for analysisd EPS limitation ([#3509](https://github.com/wazuh/wazuh-qa/pull/3509)) \- (Framework + Tests) - New testing suite for checking analysisd EPS limitation ([#2947](https://github.com/wazuh/wazuh-qa/pull/3181)) \- (Framework + Tests) @@ -89,14 +102,9 @@ Release report: TBD ### Changed -- Fix `test_file_limit_delete_full` module ([#3990](https://github.com/wazuh/wazuh-qa/pull/3990)) \- (Tests) - Improve `test_agent_groups_new_cluster_node` ([#3971](https://github.com/wazuh/wazuh-qa/pull/3971)) \- (Tests) -- Fix Solaris agent provision schema ([#3750](https://github.com/wazuh/wazuh-qa/issues/3744)) \- (Framework) -- Fix wazuh-db integration tests for agent-groups ([#3926](https://github.com/wazuh/wazuh-qa/pull/3926)) \- (Tests + Framework) -- Fix `test_set_agent_groups` ([#3920](https://github.com/wazuh/wazuh-qa/pull/3920)) \- (Tests) - Improve `test_assign_groups_guess` ([#3901](https://github.com/wazuh/wazuh-qa/pull/3901)) \- (Tests) - Update `test_cluster_worker_logs_order` test ([#3896](https://github.com/wazuh/wazuh-qa/pull/3896)) \- (Tests) -- Fix `test_agent_groups` ([#3889](https://github.com/wazuh/wazuh-qa/pull/3889)) \- (Tests + Framework) - Increase NVE download feed test timeout([#3769](https://github.com/wazuh/wazuh-qa/pull/3769)) \- (Tests) - Adapt wazuhdb integration tests for auto-vacuum ([#3613](https://github.com/wazuh/wazuh-qa/issues/3613)) \- (Tests) - Update logcollector format test due to audit changes ([#3641](https://github.com/wazuh/wazuh-qa/pull/3641)) \- (Framework) @@ -137,8 +145,16 @@ Release report: TBD ### Fixed +- Fix `test_assign_agent_group_with_enrollment` ([#3956](https://github.com/wazuh/wazuh-qa/pull/3956)) \- (Tests) +- Fix `test_file_limit_delete_full` module ([#3990](https://github.com/wazuh/wazuh-qa/pull/3990)) \- (Tests) +- Fix test_agent_groups system test ([#3955](https://github.com/wazuh/wazuh-qa/pull/3964)) \- (Tests) +- Fix Solaris agent provision schema ([#3750](https://github.com/wazuh/wazuh-qa/issues/3744)) \- (Framework) +- Fix wazuh-db integration tests for agent-groups ([#3926](https://github.com/wazuh/wazuh-qa/pull/3926)) \- (Tests + Framework) +- Fix `test_set_agent_groups` ([#3920](https://github.com/wazuh/wazuh-qa/pull/3920)) \- (Tests) - Fix test_sync_agent_groups_get, replace hardcoded hash to a dinamically calculated one ([#3895](https://github.com/wazuh/wazuh-qa/pull/3895)) \- (Framework + Tests) +- Fix `test_agent_groups` ([#3889](https://github.com/wazuh/wazuh-qa/pull/3889)) \- (Tests + Framework) - Fix test_db_backup for Ubuntu OS ([#3802](https://github.com/wazuh/wazuh-qa/pull/3802)) \- (Tests) +- Fix Yara and VirusTotal E2E basic usage tests ([#3660](https://github.com/wazuh/wazuh-qa/pull/3660)) \- (Tests) - Fix commit option of the scan module for master case ([#3157](https://github.com/wazuh/wazuh-qa/pull/3157)) \- (Tests) - Fix Vulnerability Detector IT: test_validate_feed_content yaml cases had wrong extension. ([#3299](https://github.com/wazuh/wazuh-qa/pull/3299)) \- (Tests) - Fix Analysisd IT: test_syscollector_events failure on wait_for_analysisd_startup. ([#3110](https://github.com/wazuh/wazuh-qa/pull/3110)) \- (Tests) @@ -151,12 +167,18 @@ Release report: TBD - Fix error in requirements.txt ([#3689](https://github.com/wazuh/wazuh-qa/pull/3689)) \- (Framework) - Fix sleep time in `test_agent_default_group_added`. ([#3692](https://github.com/wazuh/wazuh-qa/pull/3692)) \- (Tests) - Fix syscollector deltas integration tests. ([#3695](https://github.com/wazuh/wazuh-qa/pull/3695)) \- (Tests) +- Fix test_response_postprocessing: duplicated slash in API endpoints ([#4048](https://github.com/wazuh/wazuh-qa/pull/4048)) \- (Tests) ### Removed - Remove all FIM Integration skipped tests ([#2927](https://github.com/wazuh/wazuh-qa/issues/2927)) \- (Framework + Tests) - VDT ITs: Remove Debian Stretch test support. ([#3172](https://github.com/wazuh/wazuh-qa/pull/3172)) \- (Tests) +## [4.3.10] - 16-11-2022 + +Wazuh commit: https://github.com/wazuh/wazuh/commit/89530f11c9e592cd2e551432209b0080f08ff8e5 \ +Release report: https://github.com/wazuh/wazuh/issues/15372 + ## [4.3.9] - 13-10-2022 Wazuh commit: https://github.com/wazuh/wazuh-qa/commit/8af0a5083bd69765f4d7878df9d3b785bb239723 \ @@ -180,7 +202,7 @@ Release report: https://github.com/wazuh/wazuh/issues/14827 Wazuh commit: https://github.com/wazuh/wazuh/commit/e2b514bef3d148acd4bcae1a1c7fa8783b82ca3a \ Release report: https://github.com/wazuh/wazuh/issues/14562 -## Added +### Added - Added IT test to verify Active Response works with overwritten rules. ([#2984](https://github.com/wazuh/wazuh-qa/pull/2984)) \- (Framework + Tests) - Add Integratord IT - new test_integratord suite ([#3125](https://github.com/wazuh/wazuh-qa/pull/3125)) \- (Framework + Tests) - Add system test to check synchronization status in the cluster ([#3180](https://github.com/wazuh/wazuh-qa/pull/3180)) \- (Framework + Tests) diff --git a/deps/wazuh_testing/wazuh_testing/tools/__init__.py b/deps/wazuh_testing/wazuh_testing/tools/__init__.py index 1a0d4727be..ac69de8484 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/__init__.py +++ b/deps/wazuh_testing/wazuh_testing/tools/__init__.py @@ -73,6 +73,7 @@ AGENT_AUTH_BINARY_PATH = os.path.join(WAZUH_PATH, 'bin', 'agent-auth') ANALYSISD_BINARY_PATH = os.path.join(WAZUH_PATH, 'bin', 'wazuh-analysisd') ACTIVE_RESPONSE_BINARY_PATH = os.path.join(WAZUH_PATH, 'active-response', 'bin') + AGENT_GROUPS_BINARY_PATH = os.path.join(WAZUH_PATH, 'bin', 'agent_groups') if sys.platform == 'sunos5': HOSTS_FILE_PATH = os.path.join('/', 'etc', 'inet', 'hosts') diff --git a/tests/integration/test_agentd/test_agentd_parametrized_reconnections.py b/tests/integration/test_agentd/test_agentd_parametrized_reconnections.py index 1a0799fc42..71a2e53e72 100644 --- a/tests/integration/test_agentd/test_agentd_parametrized_reconnections.py +++ b/tests/integration/test_agentd/test_agentd_parametrized_reconnections.py @@ -103,7 +103,10 @@ remoted_server = None +@pytest.fixture def teardown(): + yield + global remoted_server if remoted_server is not None: remoted_server.stop() @@ -308,7 +311,7 @@ def parse_time_from_log_line(log_line): def test_agentd_parametrized_reconnections(configure_authd_server, start_authd, stop_agent, set_keys, - configure_environment, get_configuration): + configure_environment, get_configuration, teardown): ''' description: Check how the agent behaves when there are delays between connection attempts to the server. For this purpose, different values for @@ -337,6 +340,9 @@ def test_agentd_parametrized_reconnections(configure_authd_server, start_authd, - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that when the 'wazuh-agentd' daemon initializes, it connects to diff --git a/tests/integration/test_agentd/test_agentd_reconnection.py b/tests/integration/test_agentd/test_agentd_reconnection.py index f1baa75029..5a36b1c4a0 100644 --- a/tests/integration/test_agentd/test_agentd_reconnection.py +++ b/tests/integration/test_agentd/test_agentd_reconnection.py @@ -100,10 +100,13 @@ authd_server = AuthdSimulator(params[0]['SERVER_ADDRESS'], key_path=SERVER_KEY_PATH, cert_path=SERVER_CERT_PATH) +global remoted_server remoted_server = None +@pytest.fixture def teardown(): + yield global remoted_server if remoted_server is not None: remoted_server.stop() @@ -225,7 +228,8 @@ def search_error_messages(): """ -def test_agentd_reconection_enrollment_with_keys(configure_authd_server, configure_environment, get_configuration): +def test_agentd_reconection_enrollment_with_keys(configure_authd_server, configure_environment, + get_configuration, teardown): ''' description: Check how the agent behaves when losing communication with the 'wazuh-remoted' daemon and a new enrollment is sent to @@ -246,6 +250,9 @@ def test_agentd_reconection_enrollment_with_keys(configure_authd_server, configu - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that the agent enrollment is successful. @@ -310,7 +317,8 @@ def test_agentd_reconection_enrollment_with_keys(configure_authd_server, configu """ -def test_agentd_reconection_enrollment_no_keys_file(configure_authd_server, configure_environment, get_configuration): +def test_agentd_reconection_enrollment_no_keys_file(configure_authd_server, configure_environment, get_configuration, + teardown): ''' description: Check how the agent behaves when losing communication with the 'wazuh-remoted' daemon and a new enrollment is sent to @@ -331,6 +339,9 @@ def test_agentd_reconection_enrollment_no_keys_file(configure_authd_server, conf - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that the agent enrollment is successful. @@ -398,7 +409,8 @@ def test_agentd_reconection_enrollment_no_keys_file(configure_authd_server, conf """ -def test_agentd_reconection_enrollment_no_keys(configure_authd_server, configure_environment, get_configuration): +def test_agentd_reconection_enrollment_no_keys(configure_authd_server, configure_environment, get_configuration, + teardown): ''' description: Check how the agent behaves when losing communication with the 'wazuh-remoted' daemon and a new enrollment is sent to @@ -419,6 +431,9 @@ def test_agentd_reconection_enrollment_no_keys(configure_authd_server, configure - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that the agent enrollment is successful. @@ -487,7 +502,7 @@ def test_agentd_reconection_enrollment_no_keys(configure_authd_server, configure """ -def test_agentd_initial_enrollment_retries(configure_authd_server, configure_environment, get_configuration): +def test_agentd_initial_enrollment_retries(configure_authd_server, configure_environment, get_configuration, teardown): ''' description: Check how the agent behaves when it makes multiple enrollment attempts before getting its key. For this, the agent starts without keys and @@ -508,6 +523,9 @@ def test_agentd_initial_enrollment_retries(configure_authd_server, configure_env - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that the agent enrollment is successful. @@ -581,7 +599,8 @@ def test_agentd_initial_enrollment_retries(configure_authd_server, configure_env """ -def test_agentd_connection_retries_pre_enrollment(configure_authd_server, configure_environment, get_configuration): +def test_agentd_connection_retries_pre_enrollment(configure_authd_server, configure_environment, get_configuration, + teardown): ''' description: Check how the agent behaves when the 'wazuh-remoted' daemon is not available and performs multiple connection attempts to it. For this, the agent starts @@ -602,6 +621,9 @@ def test_agentd_connection_retries_pre_enrollment(configure_authd_server, config - get_configuration: type: fixture brief: Get configurations from the module. + - teardown: + type: fixture + brief: Stop the Remoted server assertions: - Verify that the agent enrollment is successful. diff --git a/tests/integration/test_agentd/test_agentd_state.py b/tests/integration/test_agentd/test_agentd_state.py index cf6248ba29..836ecde9d8 100644 --- a/tests/integration/test_agentd/test_agentd_state.py +++ b/tests/integration/test_agentd/test_agentd_state.py @@ -121,7 +121,7 @@ def add_custom_key(): @pytest.mark.parametrize('test_case', [test_case['test_case'] for test_case in test_cases], ids=[test_case['name'] for test_case in test_cases]) -def test_agentd_state(configure_environment, test_case: list): +def test_agentd_state(configure_environment, test_case): ''' description: Check that the statistics file 'wazuh-agentd.state' is created automatically and verify that the content of its fields is correct. diff --git a/tests/integration/test_api/conftest.py b/tests/integration/test_api/conftest.py index b83d7419a5..eae910d6a8 100644 --- a/tests/integration/test_api/conftest.py +++ b/tests/integration/test_api/conftest.py @@ -4,15 +4,16 @@ import os import shutil + import pytest import wazuh_testing as fw from wazuh_testing import api -from wazuh_testing.tools.file import truncate_file -from wazuh_testing.tools.monitoring import FileMonitor -from wazuh_testing.tools import services as svcs from wazuh_testing.modules.api import event_monitor as evm from wazuh_testing.tools import configuration as conf +from wazuh_testing.tools import services as svcs +from wazuh_testing.tools.file import truncate_file +from wazuh_testing.tools.monitoring import FileMonitor @pytest.fixture(scope='module') @@ -144,6 +145,7 @@ def restart_api_module(request): # Start Wazuh API svcs.control_service('start') + evm.check_api_start_log(file_monitor) @pytest.fixture(scope='module') diff --git a/tests/integration/test_api/test_middlewares/test_response_postprocessing.py b/tests/integration/test_api/test_middlewares/test_response_postprocessing.py index fd92f858ce..166c7340a7 100644 --- a/tests/integration/test_api/test_middlewares/test_response_postprocessing.py +++ b/tests/integration/test_api/test_middlewares/test_response_postprocessing.py @@ -122,7 +122,7 @@ def test_response_postprocessing(restart_api_module, get_api_details, method, en headers = api_details['auth_headers'] if use_login_token else api.get_login_headers('wrong_user', 'wrong_password') # Make an API request - response = getattr(requests, method.lower())(f"{api_details['base_url']}/{endpoint_url}", headers=headers, + response = getattr(requests, method.lower())(f"{api_details['base_url']}{endpoint_url}", headers=headers, verify=False, json=json_body) assert response.headers['Content-Type'] == 'application/problem+json; charset=utf-8' diff --git a/tests/system/README.md b/tests/system/README.md index f6712bb511..746bbaed05 100644 --- a/tests/system/README.md +++ b/tests/system/README.md @@ -110,6 +110,9 @@ required an specific testing environment located in `wazuh-qa/tests/system/provi | Functionality | Required environment | |---------------------------------------------------------------------------|--------------------------------| | test_cluster/test_agent_enrollment | enrollment_cluster | +| test_agent_auth/test_agent_auth | basic_environment | +| test_enrollment/test_enrollment | basic_environment | +| test_files_cud/test_files_cud | one_manager_agent | | test_cluster/test_agent_info_sync | basic_cluster | | test_cluster/test_agent_key_polling | basic_cluster | | test_cluster/test_agent_files_deletion | basic_cluster | diff --git a/tests/system/__init__.py b/tests/system/__init__.py index 4534a788a6..0c88cfd250 100644 --- a/tests/system/__init__.py +++ b/tests/system/__init__.py @@ -3,8 +3,9 @@ # This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 import os +import json -from wazuh_testing.tools import WAZUH_PATH, LOG_FILE_PATH, CLUSTER_LOGS_PATH +from wazuh_testing.tools import WAZUH_PATH, LOG_FILE_PATH, CLUSTER_LOGS_PATH, AGENT_GROUPS_BINARY_PATH # Agent Variables AGENT_STATUS_ACTIVE = 'active' @@ -83,9 +84,24 @@ def assign_agent_to_new_group(host, id_group, id_agent, host_manager): host_manager.run_command(host, f"/var/ossec/bin/agent_groups -q -a -i {id_agent} -g {id_group}") -def delete_group_of_agents(host, id_group, host_manager): - # Delete group - host_manager.run_command(host, f"/var/ossec/bin/agent_groups -q -r -g {id_group}") +def delete_agent_group(host, id_group, host_manager, method='tool'): + """Function to delete a group. + Args: + host (str): Host name where the query will be executed. + id_group (str): Name of the group from which the id will be obtained. + host_manager (obj): Instance of HostManager. + method (str): Method to be used to delete the group. Default: tool. + """ + if method == 'tool': + host_manager.run_command(host, f"{AGENT_GROUPS_BINARY_PATH} -q -r -g {id_group}") + elif method == 'api': + master_token = host_manager.get_api_token(host) + host_manager.make_api_call(host=host, method='DELETE', token=master_token, + endpoint=f"/groups?groups_list={id_group}") + elif method == 'folder': + host_manager.run_command(host, f"rm -rf /var/ossec/etc/shared/{id_group}") + else: + raise ValueError(f"{method} is not a valid method, it should be tool, api or folder") def check_agent_groups(agent_id, group_to_check, hosts_list, host_manager): @@ -132,6 +148,33 @@ def change_agent_group_with_wdb(agent_id, new_group, host, host_manager): def execute_wdb_query(query, host, host_manager): + """Function to execute wdb query. + Args: + query (str): Query to execute + host (str): Host name where the query will be executed. + host_manager (obj): Instance of HostManager. + Returns: + response (str): Obtained response. + """ response = host_manager.run_command(host, f"python3 {WAZUH_PATH}/bin/wdb-query.py {query}") return response + + +def get_group_id(group_name, host, host_manager): + """Function to obtain the group ID. + Args: + group_name (str): Name of the group from which the id will be obtained. + host (str): Host name where the query will be executed. + host_manager (obj): Instance of HostManager. + Returns: + group_id (int): Obtained group ID. + """ + group_table_command = 'sql select * from `group`;' + query = f"global '{group_table_command}'" + group_table = execute_wdb_query(query, host, host_manager) + for group_data in json.loads(group_table): + if group_data['name'] == group_name: + group_id = group_data['id'] + + return group_id diff --git a/tests/system/pytest.ini b/tests/system/pytest.ini index d0c7187a0c..4781cb1cad 100644 --- a/tests/system/pytest.ini +++ b/tests/system/pytest.ini @@ -5,6 +5,7 @@ markers = server enrollment_cluster_env: Enrollment cluster environment system tests basic_cluster_env: Basic cluster environment system tests + basic_environment_env: Basic environment. One manager and one agent agentless_cluster_env: Agentless cluster environment system tests manager_agent_env: Manager agent environment system tests one_manager_agent_env: One manager agent environment system tests diff --git a/tests/system/test_active_response_log_format/test_active_response_log_format.py b/tests/system/test_active_response_log_format/test_active_response_log_format.py index b0988374ab..7f8cd3d4af 100644 --- a/tests/system/test_active_response_log_format/test_active_response_log_format.py +++ b/tests/system/test_active_response_log_format/test_active_response_log_format.py @@ -63,8 +63,8 @@ tmp_path = os.path.join(local_path, 'tmp') log_path = "/var/log/secure" ip = ".".join(str(randint(0, 255)) for _ in range(4)) -log_sample = f"""Dec 9 22:15:40 localhost sshd[5332]: Failed password for invalid - user BALROG from {ip} port 52620 '$token': `132`! ssh2\n\n""" +log_sample = f"Dec 9 22:15:40 localhost sshd[5332]: Failed password for invalid user BALROG from {ip} port 52620" + \ + "'$token': `132`! ssh2\n\n" sleep_time = 5 @@ -96,6 +96,7 @@ def test_active_response_log_format(wazuh_agent, message_file): # Clear the agents files that will be monitored. enviroment_files = [(wazuh_agent, os.path.join(WAZUH_LOGS_PATH, 'ossec.log')), (wazuh_agent, os.path.join(WAZUH_LOGS_PATH, 'active-responses.log'))] + clean_environment(host_manager, enviroment_files) # Add log message to agent monitored source diff --git a/tests/system/test_agent_auth/test_agent_auth.py b/tests/system/test_agent_auth/test_agent_auth.py index 8934273e44..dcc6c7ae8a 100644 --- a/tests/system/test_agent_auth/test_agent_auth.py +++ b/tests/system/test_agent_auth/test_agent_auth.py @@ -35,6 +35,8 @@ from wazuh_testing.tools.utils import format_ipv6_long +pytestmark = [pytest.mark.basic_environment_env] + # Hosts testinfra_hosts = ["wazuh-manager", "wazuh-agent1"] diff --git a/tests/system/test_cluster/test_agent_groups/data/cases_remove_group.yaml b/tests/system/test_cluster/test_agent_groups/data/cases_remove_group.yaml new file mode 100644 index 0000000000..36568b1e43 --- /dev/null +++ b/tests/system/test_cluster/test_agent_groups/data/cases_remove_group.yaml @@ -0,0 +1,39 @@ +- name: api + description: remove group with api + configuration_parameters: null + metadata: + method: | + delete_agent_group(test_infra_managers[0], group, host_manager, 'api') + deleted: true + +- name: tool + description: remove group with agent_groups + configuration_parameters: null + metadata: + method: | + delete_agent_group(test_infra_managers[0], group, host_manager, 'tool') + deleted: true + +- name: master_folder + description: remove group by removing its folder in master node + configuration_parameters: null + metadata: + method: | + delete_agent_group(test_infra_managers[0], group, host_manager, 'folder') + deleted: true + +- name: worker1_folder + description: remove group by removing its folder in worker node + configuration_parameters: null + metadata: + method: | + delete_agent_group(test_infra_managers[1], group, host_manager, 'folder') + deleted: false + +- name: worker2_folder + description: remove group by removing its folder in worker node + configuration_parameters: null + metadata: + method: | + delete_agent_group(test_infra_managers[2], group, host_manager, 'folder') + deleted: false diff --git a/tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml b/tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml new file mode 100644 index 0000000000..3c7dc147ee --- /dev/null +++ b/tests/system/test_cluster/test_agent_groups/data/enrollment_group_messages.yaml @@ -0,0 +1,4 @@ +wazuh-master: + - regex: .*Agent-groups send full.*Finished in.* + path: /var/ossec/logs/cluster.log + timeout: 60 diff --git a/tests/system/test_cluster/test_agent_groups/data/remove_group_messages.yaml b/tests/system/test_cluster/test_agent_groups/data/remove_group_messages.yaml new file mode 100644 index 0000000000..44b6788c23 --- /dev/null +++ b/tests/system/test_cluster/test_agent_groups/data/remove_group_messages.yaml @@ -0,0 +1,4 @@ +wazuh-master: + - regex: .*Agent-groups send full.* Finished.* + path: var/ossec/logs/cluster.log + timeout: 60 diff --git a/tests/system/test_cluster/test_agent_groups/test_agent_groups_new_cluster_node.py b/tests/system/test_cluster/test_agent_groups/test_agent_groups_new_cluster_node.py index 3e963d5b69..df825986ef 100644 --- a/tests/system/test_cluster/test_agent_groups/test_agent_groups_new_cluster_node.py +++ b/tests/system/test_cluster/test_agent_groups/test_agent_groups_new_cluster_node.py @@ -60,7 +60,6 @@ test_infra_new_nodes = ["wazuh-worker3"] test_infra_agents = ["wazuh-agent1", "wazuh-agent2"] agent_groups = ["Group1", "Group2"] -pytestmark = [pytest.mark.cluster] inventory_path = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))), 'provisioning', 'four_manager_disconnected_node', 'inventory.yml') diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py index f06566f55a..5531ea9452 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_group_with_enrollment.py @@ -45,8 +45,9 @@ import time import pytest -from system import (AGENT_GROUPS_DEFAULT, ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, restart_cluster, - check_keys_file, delete_group_of_agents, check_agent_groups_db) +from system import (ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, restart_cluster, check_keys_file, delete_agent_group, + check_agent_groups_db) +from wazuh_testing.tools.monitoring import HostMonitor from wazuh_testing.tools.system import HostManager from wazuh_testing.tools import WAZUH_PATH @@ -62,11 +63,12 @@ host_manager = HostManager(inventory_path) local_path = os.path.dirname(os.path.abspath(__file__)) tmp_path = os.path.join(local_path, 'tmp') +data_path = os.path.join(local_path, 'data') +messages_path = os.path.join(data_path, 'enrollment_group_messages.yaml') +timeout_full_task_end = 60 # Variables -timeout = 15 id_group = 'group_test' -path_cluster = '/framework/python/lib/python3.9/site-packages/wazuh-4.4.0-py3.9.egg/wazuh/core/cluster/cluster.json' enrollment_group = f""" {id_group} @@ -78,9 +80,8 @@ @pytest.mark.parametrize("agent_target", ["wazuh-worker1"]) def test_assign_agent_to_a_group(agent_target, clean_environment): ''' - description: Check race condition when an agent enrollment process with a group connects to the worker, - when worker no receive information about the group and when data of groups is receive, - the group is change. + description: Check that when an agent registers in a worker, with a group assigned in the enrollment section, + the agent has that group assigned in the worker's database. wazuh_min_version: 4.4.0 parameters: - agent_target: @@ -91,22 +92,14 @@ def test_assign_agent_to_a_group(agent_target, clean_environment): brief: Reset the wazuh log files at the start of the test. Remove all registered agents from master. assertions: - Verify that after registering the agent key file exists in all nodes. - - Verify that after registering and before receiving agent group info, it has the 'default' group assigned. - Verify that after registering and after receiving agent group info, it has the 'group_test' group assigned. expected_output: - The agent 'Agent_name' with ID 'Agent_id' belongs to groups: group_test." ''' - replace = '\n' + ' "timeout_agent_groups": 40,' '\n' + ' "agent_group_start_delay": 300,\n' - - # Add modify agent_group_start_delay - host_manager.add_block_to_file(host=test_infra_managers[0], path=f"{WAZUH_PATH}{path_cluster}", - after='"timeout_agent_info": 40,', before='"check_worker_lastkeepalive": 60,', - replace=replace) - # Create new group host_manager.run_command(test_infra_managers[0], f"/var/ossec/bin/agent_groups -q -a -g {id_group}") - worker_ip = host_manager.run_command(agent_target, f'hostname -i') + worker_ip = host_manager.run_command(agent_target, 'hostname -i') # Modify ossec.conf in agent host_manager.add_block_to_file(host=test_infra_agents[0], path=f"{WAZUH_PATH}/etc/ossec.conf", @@ -114,29 +107,18 @@ def test_assign_agent_to_a_group(agent_target, clean_environment): host_manager.add_block_to_file(host=test_infra_agents[0], path=f"{WAZUH_PATH}/etc/ossec.conf", after="
", before="
", replace=worker_ip) - restart_cluster([test_infra_managers[0]] + test_infra_agents, host_manager) - time.sleep(timeout) + restart_cluster(test_infra_agents, host_manager) + + time.sleep(timeout_full_task_end) # Check that agent has client key file assert check_keys_file(test_infra_agents[0], host_manager), ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND try: - # Chech that the worker has the default group + # Check that agent has expected group assigned query = 'sql select id, `group` from agent;' - check_agent_groups_db(query, AGENT_GROUPS_DEFAULT, test_infra_managers[1], host_manager) - - replace = '\n' + ' "timeout_agent_groups": 40,' '\n' + ' "agent_group_start_delay": 1,\n' - - # Add modify agent_group_start_delay - host_manager.add_block_to_file(host=test_infra_managers[0], path=f"{WAZUH_PATH}{path_cluster}", - after='"timeout_agent_info": 40,', before='"check_worker_lastkeepalive": 60,', - replace=replace) - - restart_cluster([test_infra_managers[0]], host_manager) - time.sleep(timeout) - # Check that agent has group set to default and then override group info check_agent_groups_db(query, id_group, test_infra_managers[1], host_manager) finally: # Delete group of agent - delete_group_of_agents(test_infra_managers[0], id_group, host_manager) + delete_agent_group(test_infra_managers[0], id_group, host_manager) diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_never_connected_to_group.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_never_connected_to_group.py index a2db055120..6783b023d8 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_never_connected_to_group.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_never_connected_to_group.py @@ -44,7 +44,7 @@ import pytest from system.test_cluster.test_agent_groups.common import register_agent -from system import (check_agent_groups, check_agent_status, check_keys_file, delete_group_of_agents, +from system import (check_agent_groups, check_agent_status, check_keys_file, delete_agent_group, AGENT_STATUS_NEVER_CONNECTED, ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND) from wazuh_testing.tools.system import HostManager @@ -105,4 +105,4 @@ def test_assign_agent_to_a_group(agent_target, clean_environment): finally: # Delete group of agent - delete_group_of_agents('wazuh-master', id_group, host_manager) + delete_agent_group('wazuh-master', id_group, host_manager) diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py index b234ba8743..27a7806282 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group.py @@ -47,7 +47,7 @@ from system.test_cluster.test_agent_groups.common import register_agent from system import (AGENT_NO_GROUPS, AGENT_STATUS_ACTIVE, AGENT_STATUS_DISCONNECTED, check_agent_groups, check_agent_status, restart_cluster, check_keys_file, assign_agent_to_new_group, - delete_group_of_agents, ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, create_new_agent_group) + delete_agent_group, ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, create_new_agent_group) from wazuh_testing.modules import WAZUH_SERVICE_PREFIX, WAZUH_SERVICES_STOPPED from wazuh_testing.tools.system import HostManager @@ -55,7 +55,7 @@ # Hosts test_infra_managers = ["wazuh-master", "wazuh-worker1", "wazuh-worker2"] test_infra_agents = ["wazuh-agent1"] -pytestmark = [pytest.mark.cluster] +pytestmark = [pytest.mark.cluster, pytest.mark.enrollment_cluster_env] inventory_path = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))), 'provisioning', 'enrollment_cluster', 'inventory.yml') @@ -128,4 +128,4 @@ def test_assign_agent_to_a_group(agent_target, initial_status, clean_environment finally: # Delete group of agent - delete_group_of_agents('wazuh-master', test_group, host_manager) + delete_agent_group('wazuh-master', test_group, host_manager) diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_api.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_api.py index 5f0b842bcd..0567cb03fe 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_api.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_api.py @@ -46,7 +46,7 @@ from system.test_cluster.test_agent_groups.common import register_agent from system import (AGENT_NO_GROUPS, AGENT_STATUS_ACTIVE, AGENT_STATUS_DISCONNECTED, ERR_MSG_FAILED_TO_SET_AGENT_GROUP, ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, check_agent_groups, check_agent_status, restart_cluster, - check_keys_file, delete_group_of_agents, create_new_agent_group) + check_keys_file, delete_agent_group, create_new_agent_group) from wazuh_testing.tools.system import HostManager @@ -131,4 +131,4 @@ def test_assign_agent_to_a_group(agent_target, initial_status, clean_environment # Delete group of agent finally: - delete_group_of_agents(test_infra_managers[0], test_group, host_manager) + delete_agent_group(test_infra_managers[0], test_group, host_manager) diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_by_tool.py b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_by_tool.py index 3cc3c5cc14..6fcf8768c8 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_by_tool.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_agent_to_a_group_by_tool.py @@ -48,7 +48,7 @@ from system.test_cluster.test_agent_groups.common import register_agent from system import (check_agent_groups, check_agent_status, check_keys_file, create_new_agent_group, - delete_group_of_agents, assign_agent_to_new_group, AGENT_NO_GROUPS, AGENT_STATUS_NEVER_CONNECTED) + delete_agent_group, assign_agent_to_new_group, AGENT_NO_GROUPS, AGENT_STATUS_NEVER_CONNECTED) from wazuh_testing.tools.system import HostManager @@ -117,4 +117,4 @@ def test_assign_agent_to_a_group_by_tool(agent_target, clean_environment): finally: # Delete group of agent - delete_group_of_agents(test_infra_managers[0], group_id, host_manager) + delete_agent_group(test_infra_managers[0], group_id, host_manager) diff --git a/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py b/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py index 6d5ccd7b7a..6d56111ad8 100644 --- a/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py +++ b/tests/system/test_cluster/test_agent_groups/test_assign_groups_guess.py @@ -46,7 +46,7 @@ from system.test_cluster.test_agent_groups.common import register_agent from system import (ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, check_agent_groups, check_keys_file, - create_new_agent_group, delete_group_of_agents, remove_cluster_agents, + create_new_agent_group, delete_agent_group, remove_cluster_agents, assign_agent_to_new_group, restart_cluster) from wazuh_testing.tools.system import HostManager from wazuh_testing.tools.file import replace_regex_in_file @@ -95,7 +95,7 @@ def modify_local_internal_options(status_guess_agent_group): backup_local_internal_options = host_manager.get_file_content(test_infra_managers[0], WAZUH_LOCAL_INTERNAL_OPTIONS) # Add local internal options - host_manager.configure_internal_options(local_internal_options) + host_manager.configure_local_internal_options(local_internal_options) yield @@ -189,7 +189,7 @@ def test_guess_single_group(target_node, status_guess_agent_group, clean_environ finally: # Delete group of agent - delete_group_of_agents(test_infra_managers[0], group_id, host_manager) + delete_agent_group(test_infra_managers[0], group_id, host_manager) replace_regex_in_file([agent_id, expected_group], ['AGENT_ID', 'GROUP_ID'], messages_path) @@ -285,5 +285,5 @@ def test_guess_multigroups(n_agents, target_node, status_guess_agent_group, clea finally: # Delete group of agent - delete_group_of_agents(test_infra_managers[0], group_id, host_manager) + delete_agent_group(test_infra_managers[0], group_id, host_manager) replace_regex_in_file([agent1_id, expected_group], ['AGENT_ID', 'GROUP_ID'], messages_path) diff --git a/tests/system/test_cluster/test_agent_groups/test_remove_group.py b/tests/system/test_cluster/test_agent_groups/test_remove_group.py new file mode 100644 index 0000000000..ad140ded38 --- /dev/null +++ b/tests/system/test_cluster/test_agent_groups/test_remove_group.py @@ -0,0 +1,132 @@ +import os +import pytest +from time import sleep + +from system import (ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND, check_agent_groups, check_keys_file, + create_new_agent_group, assign_agent_to_new_group, restart_cluster, execute_wdb_query, get_group_id, + delete_agent_group) +from wazuh_testing import T_10 +from system.test_cluster.test_agent_groups.common import register_agent +from wazuh_testing.tools.configuration import get_test_cases_data +from wazuh_testing.tools.monitoring import HostMonitor +from wazuh_testing.tools.system import HostManager + +pytestmark = [pytest.mark.cluster, pytest.mark.enrollment_cluster_env] + +# Hosts +test_infra_managers = ['wazuh-master', 'wazuh-worker1', 'wazuh-worker2'] +test_infra_agents = ['wazuh-agent1', 'wazuh-agent2'] + +inventory_path = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))), + 'provisioning', 'enrollment_cluster', 'inventory.yml') +data_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'data') +host_manager = HostManager(inventory_path) +local_path = os.path.dirname(os.path.abspath(__file__)) +tmp_path = os.path.join(local_path, 'tmp') +t1_cases_path = os.path.join(data_path, 'cases_remove_group.yaml') +messages_path = os.path.join(data_path, 'remove_group_messages.yaml') + +# Variables +t1_configuration_parameters, t1_configuration_metadata, t1_case_ids = get_test_cases_data(t1_cases_path) +queries = ['sql select `group` from agent;', 'sql select name from `group`;', 'sql select id_group from belongs;'] + + +# Fixtures +@pytest.fixture() +def pre_configured_groups(target_node, group): + """Fixture to create a group and assign an agent during the setup. + Args: + target_node (str): Name of the host where the agent will register. + group (str): Group name. + """ + # Create group + if group != 'default': + create_new_agent_group(test_infra_managers[0], group, host_manager) + + # Register agent with agent-auth + agent_ip, agent_id, agent_name, manager_ip = register_agent(test_infra_agents[0], target_node, + host_manager) + + # Restart agent + restart_cluster([test_infra_agents[0]], host_manager) + + # Check that agent has client key file + assert check_keys_file(test_infra_agents[0], host_manager), ERR_MSG_CLIENT_KEYS_IN_MASTER_NOT_FOUND + + # Assign agent to group + if group != 'default': + assign_agent_to_new_group(test_infra_managers[0], group, agent_id, host_manager) + + # Check that agent has group assigned on every node + check_agent_groups(agent_id, group, test_infra_managers, host_manager) + + yield + + if group != 'default': + delete_agent_group(test_infra_managers[0], group, host_manager) + + +# Tests +@pytest.mark.parametrize('metadata', t1_configuration_metadata, ids=t1_case_ids) +@pytest.mark.parametrize('group', ['group_test']) +@pytest.mark.parametrize('target_node', ['wazuh-master', 'wazuh-worker1']) +def test_remove_group(metadata, group, target_node, pre_configured_groups, clean_environment): + ''' + description: Check that a group is completely deleted from all nodes when using different deletion methods, with the + exception of cases where the group folder is deleted on a worker node. + wazuh_min_version: 4.4.0 + parameters: + - metadata: + type: dict + brief: Get metadata from the module. + - group: + type: string + brief: Group name. + - target_node: + type: string + brief: Name of the host where the agent will register. + - pre_configured_groups: + type: fixture + brief: Create group, register and assign agent during the setup. + - clean_environment: + type: fixture + brief: Reset the wazuh log files at the start of the test. Remove all registered agents from master. + assertions: + - Verify [Agent-groups send full] task finished when the group folder is removed in a worker node. + - Verify group name is present in agent table when the group folder is removed in a worker node. + - Verify group id is present in agent table when the group folder is removed in a worker node. + - Verify group name is not present in agent table when group is deleted. + - Verify group id is not present in agent table when group is deleted. + ''' + # Get group IDs + group_ids = {} + for manager in test_infra_managers: + group_ids[manager] = str(get_group_id(group, manager, host_manager)) + + # Delete group + exec(metadata['method']) + sleep(T_10) + + if not metadata['deleted']: + HostMonitor(inventory_path=inventory_path, + messages_path=messages_path, + tmp_path=tmp_path).run(update_position=True) + + for manager in test_infra_managers: + group_ids[manager] = str(get_group_id(group, manager, host_manager)) + + # Check group is deleted or not if expected in agent table in every node + for query in queries: + for manager in test_infra_managers: + global_query = f"global '{query}'" + response = execute_wdb_query(global_query, manager, host_manager) + if metadata['deleted']: + if 'id_group' in query: + assert group_ids[manager] not in response, f"Group not deleted correctly in {manager}" + else: + assert group not in response, f"Group not deleted correctly in {manager}" + else: + if 'id_group' in query: + assert group_ids[manager] in response, f"Group deleted in {manager}" + else: + assert group in response, f"Group deleted in {manager}" diff --git a/tests/system/test_enrollment/test_enrollment.py b/tests/system/test_enrollment/test_enrollment.py index 7f2df2d925..420b4fdac3 100644 --- a/tests/system/test_enrollment/test_enrollment.py +++ b/tests/system/test_enrollment/test_enrollment.py @@ -39,9 +39,12 @@ from wazuh_testing.tools.utils import format_ipv6_long +pytestmark = [pytest.mark.basic_environment_env] + # Hosts testinfra_hosts = ['wazuh-manager', 'wazuh-agent1'] + inventory_path = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'provisioning', 'basic_environment', 'inventory.yml') host_manager = HostManager(inventory_path) diff --git a/tests/system/test_fim/test_files/test_files_cud.py b/tests/system/test_fim/test_files/test_files_cud.py index 0d45911f8a..9a483887b9 100644 --- a/tests/system/test_fim/test_files/test_files_cud.py +++ b/tests/system/test_fim/test_files/test_files_cud.py @@ -49,6 +49,8 @@ from wazuh_testing.fim import create_folder_file, wait_for_fim_scan_end +pytestmark = [pytest.mark.one_manager_agent_env] + # Hosts testinfra_hosts = ["wazuh-manager", "wazuh-agent1"] diff --git a/version.json b/version.json index 2b2057d4bf..da2c152cda 100644 --- a/version.json +++ b/version.json @@ -1,4 +1,4 @@ { "version": "4.5.0", - "revision": "1" + "revision": "40500" } From c14ca8b2610b27268aae5760ff9506c81b314fb1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mauro=20Agust=C3=ADn=20Malara=20Zapata?= <39094716+mauromalara@users.noreply.github.com> Date: Tue, 18 Apr 2023 17:11:32 +0200 Subject: [PATCH 19/34] feat(#3545): add test to check the syscollector configuration * feat(#3545): add test to check the syscollector configuration. * fix(#3545): fix errors when running tests in agents. * fix(#3545): modify the way the test restarts deamons. * fix(#3545): fix syscollector DB path in Windows. * fix(#3545): fix syscollector db path variable name. * fix(#3545): fix globalDB error due to execution in agent. * style(#3545): fix linter errors. * docs(#3545): add PR to changelog. * fix(#3545): fix some errors present in Windows tests. * fix(#3545): fix file monitor declaration. * fix(#3545): fix all_scans_disabled test. * refactor(#3545): change the timeout of filemonitor. * fix(#3545): fix macOS tests. * refactor(#3545): add mark to run the test on unix only. * fix(#3545): fix Windows tests. * docs(#3545): mark test as xfail because of an existing bug. * fix(#3545): remove the mark from unix tests. * fix(#3545): reuse an existing function and remove the utilized. * style(#3545): apply identation. * fix(#3545): fix naming and used functions. * fix(#3545): move fixture to integration conftest. * fix(#3545): improve a function name. * refactor(#3545): add new case, disable unused modules and minor changes. * fix(#3545): fix prefix. * fix(#3545): fix metadata because NoneType error. * fix(#3545): fix event monitor and truncate function. * refactor(#3545): remove the max_eps empty test case. It is not a critical field, so it will not thrown an error when empty. * fix(#3545): solve the log position problem when searching a message. * fix(#3545): apply linter corrections. * fix(#3545): fix the test configuration data. * fix(#3545): remove unused import and docs changed. * fix(#3545): change way of importing and minor changes. * fix(#3545): use param depending on the platform. * refactor(#3545): remove unused fixture and change callback. * fix(#3545): change the default argument for prefix. * style(#3545): add spaces for better visualization. * refactor(#3545): improve docs and change some logic. * docs(#3545): add comments and new documentation. * fix(#3545): fix NoneType error. * docs(#3545): fix changelog. * docs(#3545): add docs for file_to_monitor param. Improve existing docs. * refactor(#3545): remove duplicated function and improve documentation * fix(#3545): remove unused imports and sort the remaining ones. * docs(#3545): add docs to wrapped fixture. * fix(#3545): remove xfail mark and add note to mark. * docs(#3545): remove duplicated line. * style(#3545): sort imports according the guidelines. * docs(#3545): move change to 4.4.2 section in CHANGELOG. --- CHANGELOG.md | 1 + conftest.py | 2 +- deps/wazuh_testing/wazuh_testing/__init__.py | 3 + .../wazuh_testing/event_monitor.py | 16 +- .../wazuh_testing/modules/__init__.py | 9 +- .../modules/syscollector/__init__.py | 0 .../modules/syscollector/event_monitor.py | 311 ++++++++++++ .../wazuh_testing/qa_docs/schema.yaml | 2 + .../wazuh_testing/tools/configuration.py | 7 +- tests/integration/conftest.py | 39 +- .../configuration_syscollector.yaml | 53 +++ .../configuration_syscollector_no_tags.yaml | 26 + ...iguration_syscollector_scans_disabled.yaml | 49 ++ .../case_test_all_scans_disabled.yaml | 26 + .../test_cases/case_test_default_values.yaml | 5 + .../case_test_invalid_configurations.yaml | 436 +++++++++++++++++ .../data/test_cases/case_test_scanning.yaml | 17 + .../case_test_syscollector_deactivation.yaml | 28 ++ .../test_syscollector_configuration.py | 446 ++++++++++++++++++ 19 files changed, 1445 insertions(+), 31 deletions(-) create mode 100644 deps/wazuh_testing/wazuh_testing/modules/syscollector/__init__.py create mode 100644 deps/wazuh_testing/wazuh_testing/modules/syscollector/event_monitor.py create mode 100644 tests/integration/test_syscollector/data/configuration/configuration_syscollector.yaml create mode 100644 tests/integration/test_syscollector/data/configuration/configuration_syscollector_no_tags.yaml create mode 100644 tests/integration/test_syscollector/data/configuration/configuration_syscollector_scans_disabled.yaml create mode 100644 tests/integration/test_syscollector/data/test_cases/case_test_all_scans_disabled.yaml create mode 100644 tests/integration/test_syscollector/data/test_cases/case_test_default_values.yaml create mode 100644 tests/integration/test_syscollector/data/test_cases/case_test_invalid_configurations.yaml create mode 100644 tests/integration/test_syscollector/data/test_cases/case_test_scanning.yaml create mode 100644 tests/integration/test_syscollector/data/test_cases/case_test_syscollector_deactivation.yaml create mode 100644 tests/integration/test_syscollector/test_syscollector_configuration.py diff --git a/CHANGELOG.md b/CHANGELOG.md index 00acf3a907..1346efa630 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ All notable changes to this project will be documented in this file. ### Added +- Add test to check the Syscollector configuration. ([#3584](https://github.com/wazuh/wazuh-qa/pull/3584)) \- (Framework + Tests) - Add system tests for groups deletion ([#4057](https://github.com/wazuh/wazuh-qa/pull/4057)) \- (Tests) ### Fixed diff --git a/conftest.py b/conftest.py index bb61a281ed..d465af7d28 100644 --- a/conftest.py +++ b/conftest.py @@ -1,6 +1,6 @@ import pytest + def pytest_collectreport(report): if report.failed: pass - diff --git a/deps/wazuh_testing/wazuh_testing/__init__.py b/deps/wazuh_testing/wazuh_testing/__init__.py index acb4b49b6d..28e83baf11 100644 --- a/deps/wazuh_testing/wazuh_testing/__init__.py +++ b/deps/wazuh_testing/wazuh_testing/__init__.py @@ -13,12 +13,14 @@ if sys.platform == 'win32': WAZUH_PATH = os.path.join("C:", os.sep, "Program Files (x86)", "ossec-agent") LOG_FILE_PATH = os.path.join(WAZUH_PATH, 'ossec.log') + SYSCOLLECTOR_DB_PATH = os.path.join(WAZUH_PATH, 'queue', 'syscollector', 'db', 'local.db') else: if sys.platform == 'darwin': WAZUH_PATH = os.path.join("/", "Library", "Ossec") else: WAZUH_PATH = os.path.join("/var", "ossec") LOG_FILE_PATH = os.path.join(WAZUH_PATH, 'logs', 'ossec.log') + SYSCOLLECTOR_DB_PATH = os.path.join(WAZUH_PATH, 'queue', 'syscollector', 'db', 'local.db') WAZUH_CONF_PATH = os.path.join(WAZUH_PATH, 'etc', 'ossec.conf') @@ -64,6 +66,7 @@ ANALYSISD_STATE = os.path.join(WAZUH_PATH, 'var', 'run', 'wazuh-analysisd.state') # Timeouts +T_2 = 2 T_5 = 5 T_10 = 10 T_20 = 20 diff --git a/deps/wazuh_testing/wazuh_testing/event_monitor.py b/deps/wazuh_testing/wazuh_testing/event_monitor.py index 5bc4a56839..25abc72452 100644 --- a/deps/wazuh_testing/wazuh_testing/event_monitor.py +++ b/deps/wazuh_testing/wazuh_testing/event_monitor.py @@ -5,9 +5,11 @@ def make_callback(pattern, prefix=''): """Create a callback function from a text pattern. + Args: - pattern (str): String to match on the log. + pattern (str): string to match on the log. prefix (str): regular expression used as prefix before the pattern. + Returns: lambda: function that returns if there's a match in the file """ @@ -18,22 +20,24 @@ def make_callback(pattern, prefix=''): def check_event(file_monitor=None, callback='', error_message=None, update_position=True, timeout=20, - accum_results=1, file_to_monitor=None): - """Check if an API event occurs + accum_results=1, file_to_monitor=None, prefix=None): + """Check if an event occurs. + Args: file_monitor (FileMonitor): FileMonitor object to monitor the file content. callback (str): log regex to check in the file error_message (str): error message to show in case of expected event does not occur update_position (boolean): filter configuration parameter to search in the file + accum_results (int): accumulation of matches. + file_to_monitor (str): path to the file to be monitored. timeout (str): timeout to check the event in the file - prefix (str): log pattern regex - accum_results (int): Accumulation of matches. + prefix (str): prefix of the log message regex """ file_monitor = FileMonitor(file_to_monitor) if file_monitor is None else file_monitor error_message = f"Could not find this event in {file_to_monitor}: {callback}" if error_message is None else \ error_message result = file_monitor.start(timeout=timeout, update_position=update_position, accum_results=accum_results, - callback=make_callback(callback), error_message=error_message) + callback=make_callback(callback, prefix), error_message=error_message) return result diff --git a/deps/wazuh_testing/wazuh_testing/modules/__init__.py b/deps/wazuh_testing/wazuh_testing/modules/__init__.py index b6e9a50d28..8306463c1f 100644 --- a/deps/wazuh_testing/wazuh_testing/modules/__init__.py +++ b/deps/wazuh_testing/wazuh_testing/modules/__init__.py @@ -1,10 +1,7 @@ -# Copyright (C) 2015-2022, Wazuh Inc. -# Created by Wazuh, Inc. . -# This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 - ''' -The purpose of this file is to contain all the variables necessary for Wazuh in order to be easier -to maintain if one of them changes in the future. +copyright: Copyright (C) 2015-2023, Wazuh Inc. + Created by Wazuh, Inc. . + This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 ''' import pytest diff --git a/deps/wazuh_testing/wazuh_testing/modules/syscollector/__init__.py b/deps/wazuh_testing/wazuh_testing/modules/syscollector/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/deps/wazuh_testing/wazuh_testing/modules/syscollector/event_monitor.py b/deps/wazuh_testing/wazuh_testing/modules/syscollector/event_monitor.py new file mode 100644 index 0000000000..cdb537151b --- /dev/null +++ b/deps/wazuh_testing/wazuh_testing/modules/syscollector/event_monitor.py @@ -0,0 +1,311 @@ +""" +copyright: Copyright (C) 2015-2023, Wazuh Inc. + Created by Wazuh, Inc. . + This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 +""" +import sys + +from wazuh_testing import T_5 +from wazuh_testing.event_monitor import check_event + + +# Define the log messages prefix +SYSCOLLECTOR_PREFIX = '.+wazuh-modulesd:syscollector.+' +WMODULES_SYSCOLLECTOR_PREFIX = '.+wmodules_syscollector.+' + +# Callback messages +CB_MODULE_STARTING = 'DEBUG: Starting Syscollector.' +CB_MODULE_STARTED = 'INFO: Module started.' +CB_SCAN_STARTED = 'INFO: Starting evaluation.' +CB_SCAN_FINISHED = 'INFO: Evaluation finished.' +CB_SYNC_STARTED = 'DEBUG: Starting syscollector sync' +CB_SYNC_FINISHED = 'DEBUG: Ending syscollector sync' +CB_SYSCOLLECTOR_DISABLED = 'INFO: Module disabled. Exiting...' +CB_HARDWARE_SCAN_STARTED = 'DEBUG: Starting hardware scan' +CB_HARDWARE_SCAN_FINISHED = 'DEBUG: Ending hardware scan' +CB_OS_SCAN_STARTED = 'DEBUG: Starting os scan' +CB_OS_SCAN_FINISHED = 'DEBUG: Ending os scan' +CB_NETWORK_SCAN_STARTED = 'DEBUG: Starting network scan' +CB_NETWORK_SCAN_FINISHED = 'DEBUG: Ending network scan' +CB_PACKAGES_SCAN_STARTED = 'DEBUG: Starting packages scan' +CB_PACKAGES_SCAN_FINISHED = 'DEBUG: Ending packages scan' +CB_PORTS_SCAN_STARTED = 'DEBUG: Starting ports scan' +CB_PORTS_SCAN_FINISHED = 'DEBUG: Ending ports scan' +CB_PROCESSES_SCAN_STARTED = 'DEBUG: Starting processes scan' +CB_PROCESSES_SCAN_FINISHED = 'DEBUG: Ending processes scan' +CB_HOTFIXES_SCAN_STARTED = 'DEBUG: Starting hotfixes scan' +CB_HOTFIXES_SCAN_FINISHED = 'DEBUG: Ending hotfixes scan' + + +def check_module_is_starting(file_monitor=None, timeout=T_5): + """Check if the syscollector module is starting. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_MODULE_STARTING, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_module_startup_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector startup was completed. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_MODULE_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_sync_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector synchronization has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_SYNC_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_syscollector_is_disabled(file_monitor=None, timeout=T_5): + """Check if the syscollector module is disabled. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_SYSCOLLECTOR_DISABLED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_config(disabled='no', interval=3600, scan_on_start='yes', hardware='yes', os='yes', ports='yes', + network='yes', packages='yes', ports_all='no', processes='yes', hotfixes='yes', max_eps=10, + file_monitor=None, timeout=T_5): + """Check if the syscollector configuration was applied correctly. + + Args: + disabled (str): Disable the Syscollector wodle. + interval (int): Time between system scans. + scan_on_start (str): Run a system scan immediately when service is started. + hardware (str): Enables the hardware scan. + os (str): Enables the OS scan. + ports (str): Enables the ports scan. + network (str): Enables the network scan. + packages (str): Enables the packages scan. + ports_all (str): Make Wazuh only scans listening ports. + processes (str): Enables the processes scan. + hotfixes (str): Enables the hotfixes scan. + max_eps (int): Sets the maximum event reporting throughput. + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + msg = 'DEBUG:.+"disabled":"{0}","scan-on-start":"{1}","interval":{2},'.format(disabled, scan_on_start, interval) + msg += '"network":"{0}","os":"{1}","hardware":"{2}","packages":"{3}","ports":"{4}",'.format(network, os, hardware, + packages, ports) + msg += '"ports_all":"{0}","processes":"{1}",'.format(ports_all, processes) + if sys.platform == 'win32': + msg += '"hotfixes":"{0}",'.format(hotfixes) + msg += '"sync_max_eps":{0}.+'.format(max_eps) + + check_event(callback=msg, timeout=timeout, file_monitor=file_monitor) + + +def check_hardware_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector hardware scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_HARDWARE_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_hardware_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector OS scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_HARDWARE_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_os_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector OS scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_OS_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_os_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector OS scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_OS_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_network_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector network scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_NETWORK_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_network_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector network scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_NETWORK_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_packages_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector packages scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PACKAGES_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_packages_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector packages scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PACKAGES_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_ports_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector ports scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PORTS_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_ports_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector ports scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PORTS_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_processes_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector processes scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PROCESSES_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_processes_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector processes scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PROCESSES_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_hotfixes_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector hotfixes scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_HOTFIXES_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_hotfixes_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector hotfixes scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_HOTFIXES_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_tag_error(field='', file_monitor=None, timeout=T_5): + """Check if syscollector shows an error when using an invalid value in a tag. + + Args: + field (str): field that contains the error. + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + callbacks_options = { + 'max_eps': "WARNING:.+ Invalid value for element 'max_eps': .+", + 'interval': "ERROR: Invalid interval at module 'syscollector'", + 'all': f"ERROR: Invalid content for tag '{field}' at module 'syscollector'." + } + selected_callback = callbacks_options['all'] if field not in callbacks_options.keys() else callbacks_options[field] + + check_event(callback=selected_callback, timeout=timeout, prefix=WMODULES_SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_attr_error(attr='', file_monitor=None, timeout=T_5): + """Check if syscollector shows an error when using an invalid value in an attribute. + + Args: + attr (str): attribute that contains the error. + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + callback = f"ERROR: Invalid content for attribute '{attr}' at module 'syscollector'." + check_event(callback=callback, timeout=timeout, prefix=WMODULES_SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) diff --git a/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml b/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml index 88c2d4e3ea..2a65a62e99 100644 --- a/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml +++ b/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml @@ -65,6 +65,7 @@ predefined_values: - integration - logcollector - logtest + - modulesd - office365 - osquery - remoted @@ -353,6 +354,7 @@ predefined_values: - settings - shellshock - simulator + - syscollector - slack - sql_injection - ssh diff --git a/deps/wazuh_testing/wazuh_testing/tools/configuration.py b/deps/wazuh_testing/wazuh_testing/tools/configuration.py index 628c250673..0b1ed61c1b 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/configuration.py +++ b/deps/wazuh_testing/wazuh_testing/tools/configuration.py @@ -486,7 +486,12 @@ def inserter(path): for config in configurations: for section in config['sections']: - if section['elements']: + # Capture exception if there is no elements in the section + try: + elements = section['elements'] + except KeyError: + elements = None + if elements is not None: for element in section['elements']: if isinstance(element, dict): # ADD HERE all fields with format sub_element: - value diff --git a/tests/integration/conftest.py b/tests/integration/conftest.py index 99d1749ee4..91116963fd 100644 --- a/tests/integration/conftest.py +++ b/tests/integration/conftest.py @@ -14,24 +14,23 @@ from numpydoc.docscrape import FunctionDoc from py.xml import html -import wazuh_testing.tools.configuration as conf -from wazuh_testing import global_parameters, logger, ALERTS_JSON_PATH, ARCHIVES_LOG_PATH, ARCHIVES_JSON_PATH -from wazuh_testing.logcollector import create_file_structure, delete_file_structure -from wazuh_testing.tools import LOG_FILE_PATH, WAZUH_CONF, get_service, ALERT_FILE_PATH, WAZUH_LOCAL_INTERNAL_OPTIONS -from wazuh_testing.tools.configuration import get_wazuh_conf, set_section_wazuh_conf, write_wazuh_conf -from wazuh_testing.tools.file import truncate_file, recursive_directory_creation, remove_file, copy, write_file -from wazuh_testing.tools.monitoring import QueueMonitor, FileMonitor, SocketController, close_sockets -from wazuh_testing.tools.services import control_service, check_daemon_status, delete_dbs -from wazuh_testing.tools.time import TimeMachine -from wazuh_testing import mocking +from wazuh_testing import ALERTS_JSON_PATH, ARCHIVES_JSON_PATH, ARCHIVES_LOG_PATH, global_parameters, logger, mocking from wazuh_testing.db_interface.agent_db import update_os_info from wazuh_testing.db_interface.global_db import get_system, modify_system -from wazuh_testing.tools.run_simulator import syslog_simulator -from wazuh_testing.tools.configuration import get_minimal_configuration +from wazuh_testing.logcollector import create_file_structure, delete_file_structure +from wazuh_testing.tools import ALERT_FILE_PATH, LOG_FILE_PATH, WAZUH_CONF, WAZUH_LOCAL_INTERNAL_OPTIONS, get_service +from wazuh_testing.tools.configuration import get_minimal_configuration, get_wazuh_conf, write_wazuh_conf +from wazuh_testing.tools.file import copy, recursive_directory_creation, remove_file, truncate_file, write_file +from wazuh_testing.tools.monitoring import FileMonitor, QueueMonitor, SocketController, close_sockets +from wazuh_testing.tools.services import check_daemon_status, control_service, delete_dbs +from wazuh_testing.tools.time import TimeMachine +import wazuh_testing.tools.configuration as conf if sys.platform == 'win32': - from wazuh_testing.fim import KEY_WOW64_64KEY, KEY_WOW64_32KEY, delete_registry, registry_parser, create_registry + from wazuh_testing.fim import (KEY_WOW64_32KEY, KEY_WOW64_64KEY, + create_registry, delete_registry, + registry_parser) PLATFORMS = set("darwin linux win32 sunos5".split()) HOST_TYPES = set("server agent".split()) @@ -905,7 +904,7 @@ def create_file_structure_function(get_files_list): @pytest.fixture(scope='module') -def daemons_handler(get_configuration, request): +def daemons_handler(request): """Handler of Wazuh daemons. It uses `daemons_handler_configuration` of each module in order to configure the behavior of the fixture. @@ -917,7 +916,6 @@ def daemons_handler(get_configuration, request): in order to use this fixture along with invalid configuration. Default `False` Args: - get_configuration (fixture): Gets the current configuration of the test. request (fixture): Provide information on the executing test function. """ daemons = [] @@ -975,6 +973,10 @@ def daemons_handler(get_configuration, request): control_service('stop', daemon=daemon) +# Wrapper of `daemons_handler` function to change its scope from `module` to `function` +daemons_handler_function = pytest.fixture(daemons_handler.__wrapped__, scope='function') + + @pytest.fixture(scope='function') def file_monitoring(request): """Fixture to handle the monitoring of a specified file. @@ -1025,10 +1027,13 @@ def set_wazuh_configuration(configuration): conf.write_wazuh_conf(backup_config) -@pytest.fixture(scope='function') +@pytest.fixture def truncate_monitored_files(): """Truncate all the log files and json alerts files before and after the test execution""" - log_files = [LOG_FILE_PATH, ALERT_FILE_PATH] + if get_service() == 'wazuh-manager': + log_files = [LOG_FILE_PATH, ALERT_FILE_PATH] + else: + log_files = [LOG_FILE_PATH] for log_file in log_files: truncate_file(log_file) diff --git a/tests/integration/test_syscollector/data/configuration/configuration_syscollector.yaml b/tests/integration/test_syscollector/data/configuration/configuration_syscollector.yaml new file mode 100644 index 0000000000..74483c7f3a --- /dev/null +++ b/tests/integration/test_syscollector/data/configuration/configuration_syscollector.yaml @@ -0,0 +1,53 @@ +- sections: + - section: wodle + attributes: + - name: syscollector + elements: + - disabled: + value: DISABLED + - interval: + value: INVERVAL_SCAN + - scan_on_start: + value: START_ON_START + - hardware: + value: HARDWARE_SCAN + - os: + value: OS_SCAN + - network: + value: NETWORK_SCAN + - packages: + value: PACKAGES_SCAN + - ports: + value: PORTS_SCAN + attributes: + - all: ALL_PORTS + - processes: + value: PROCESSES_SCAN + - hotfixes: + value: HOTFIXES_SCAN + - synchronization: + elements: + - max_eps: + value: MAX_EPS + + - section: syscheck + elements: + - disabled: + value: 'yes' + + - section: wodle + attributes: + - name: vulnerability-detector + elements: + - disabled: + value: 'yes' + + - section: rootcheck + elements: + - disabled: + value: 'yes' + + - section: sca + elements: + - enabled: + value: 'no' diff --git a/tests/integration/test_syscollector/data/configuration/configuration_syscollector_no_tags.yaml b/tests/integration/test_syscollector/data/configuration/configuration_syscollector_no_tags.yaml new file mode 100644 index 0000000000..ee5b7cd584 --- /dev/null +++ b/tests/integration/test_syscollector/data/configuration/configuration_syscollector_no_tags.yaml @@ -0,0 +1,26 @@ +- sections: + - section: wodle + attributes: + - name: syscollector + + - section: syscheck + elements: + - disabled: + value: 'yes' + + - section: wodle + attributes: + - name: vulnerability-detector + elements: + - disabled: + value: 'yes' + + - section: rootcheck + elements: + - disabled: + value: 'yes' + + - section: sca + elements: + - enabled: + value: 'no' diff --git a/tests/integration/test_syscollector/data/configuration/configuration_syscollector_scans_disabled.yaml b/tests/integration/test_syscollector/data/configuration/configuration_syscollector_scans_disabled.yaml new file mode 100644 index 0000000000..7449c8c50a --- /dev/null +++ b/tests/integration/test_syscollector/data/configuration/configuration_syscollector_scans_disabled.yaml @@ -0,0 +1,49 @@ +- sections: + - section: wodle + attributes: + - name: syscollector + elements: + - disabled: + value: DISABLED + - interval: + value: INVERVAL_SCAN + - scan_on_start: + value: START_ON_START + - hardware: + value: HARDWARE_SCAN + - os: + value: OS_SCAN + - network: + value: NETWORK_SCAN + - packages: + value: PACKAGES_SCAN + - ports: + value: PORTS_SCAN + attributes: + - all: ALL_PORTS + - processes: + value: PROCESSES_SCAN + - hotfixes: + value: HOTFIXES_SCAN + + - section: syscheck + elements: + - disabled: + value: 'yes' + + - section: wodle + attributes: + - name: vulnerability-detector + elements: + - disabled: + value: 'yes' + + - section: rootcheck + elements: + - disabled: + value: 'yes' + + - section: sca + elements: + - enabled: + value: 'no' diff --git a/tests/integration/test_syscollector/data/test_cases/case_test_all_scans_disabled.yaml b/tests/integration/test_syscollector/data/test_cases/case_test_all_scans_disabled.yaml new file mode 100644 index 0000000000..caabe336a1 --- /dev/null +++ b/tests/integration/test_syscollector/data/test_cases/case_test_all_scans_disabled.yaml @@ -0,0 +1,26 @@ +- name: all_scans_disabled + description: Verify that the scan starts after N seconds but no scan is triggered + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 2s + START_ON_START: 'no' + HARDWARE_SCAN: 'no' + OS_SCAN: 'no' + NETWORK_SCAN: 'no' + PACKAGES_SCAN: 'no' + PORTS_SCAN: 'no' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'no' + HOTFIXES_SCAN: 'no' + metadata: + disabled: 'no' + interval_scan: 2 + start_on_start: 'no' + hardware_scan: 'no' + os_scan: 'no' + network_scan: 'no' + packages_scan: 'no' + ports_scan: 'no' + all_ports: 'no' + processes_scan: 'no' + hotfixes_scan: 'no' diff --git a/tests/integration/test_syscollector/data/test_cases/case_test_default_values.yaml b/tests/integration/test_syscollector/data/test_cases/case_test_default_values.yaml new file mode 100644 index 0000000000..4029fbb721 --- /dev/null +++ b/tests/integration/test_syscollector/data/test_cases/case_test_default_values.yaml @@ -0,0 +1,5 @@ +- name: check_default_values + description: Verify that the module starts using the default values + configuration_parameters: null + metadata: + default: null diff --git a/tests/integration/test_syscollector/data/test_cases/case_test_invalid_configurations.yaml b/tests/integration/test_syscollector/data/test_cases/case_test_invalid_configurations.yaml new file mode 100644 index 0000000000..3cd7161a78 --- /dev/null +++ b/tests/integration/test_syscollector/data/test_cases/case_test_invalid_configurations.yaml @@ -0,0 +1,436 @@ +- name: empty_value_disabled + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: '' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: disabled + attribute: null + +- name: empty_value_interval + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: '' + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: interval + attribute: null + +- name: empty_value_scan_on_start + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: '' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: scan_on_start + attribute: null + +- name: empty_value_hardware + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: '' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: hardware + attribute: null + +- name: empty_value_os + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: '' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: os + attribute: null + +- name: empty_value_network + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: '' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: network + attribute: null + +- name: empty_value_packages + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: '' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: packages + attribute: null + +- name: empty_value_ports + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: '' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: ports + attribute: null + +- name: empty_value_all_ports + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: '' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: null + attribute: all + +- name: empty_value_processes + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: '' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: processes + attribute: null + +- name: invalid_value_disabled + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: invalid + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: disabled + attribute: null + +- name: invalid_value_interval + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: invalid + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: interval + attribute: null + +- name: invalid_value_scan_on_start + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: invalid + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: scan_on_start + attribute: null + +- name: invalid_value_hardware + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: invalid + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: hardware + attribute: null + +- name: invalid_value_os + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: invalid + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: os + attribute: null + +- name: invalid_value_network + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: invalid + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: network + attribute: null + +- name: invalid_value_packages + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: invalid + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: packages + attribute: null + +- name: invalid_value_ports + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: invalid + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: ports + attribute: null + +- name: invalid_value_all_ports + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: invalid + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: null + attribute: all + +- name: invalid_value_processes + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: invalid + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: processes + attribute: null + +- name: invalid_value_max_eps + description: Verify that the module starts and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: -1 + metadata: + field: max_eps + attribute: null + +- name: empty_value_hotfixes + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: '' + MAX_EPS: 10 + metadata: + field: hotfixes + attribute: null + +- name: invalid_value_hotfixes + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: invalid + MAX_EPS: 10 + metadata: + field: hotfixes + attribute: null diff --git a/tests/integration/test_syscollector/data/test_cases/case_test_scanning.yaml b/tests/integration/test_syscollector/data/test_cases/case_test_scanning.yaml new file mode 100644 index 0000000000..76ee5decfc --- /dev/null +++ b/tests/integration/test_syscollector/data/test_cases/case_test_scanning.yaml @@ -0,0 +1,17 @@ +- name: check_syscollector_scan + description: Verify that the scan starts on startup and collects information but no sync is performed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'yes' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + dummy_metadata: '' diff --git a/tests/integration/test_syscollector/data/test_cases/case_test_syscollector_deactivation.yaml b/tests/integration/test_syscollector/data/test_cases/case_test_syscollector_deactivation.yaml new file mode 100644 index 0000000000..ff18ec8ed2 --- /dev/null +++ b/tests/integration/test_syscollector/data/test_cases/case_test_syscollector_deactivation.yaml @@ -0,0 +1,28 @@ +- name: check_syscollector_deactivation + description: Verify that the module does not start when it's disabled + configuration_parameters: + DISABLED: 'yes' + INVERVAL_SCAN: 5s + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + disabled: 'yes' + interval_scan: 5 + start_on_start: 'yes' + hardware_scan: 'yes' + os_scan: 'yes' + network_scan: 'yes' + packages_scan: 'yes' + ports_scan: 'yes' + all_ports: 'no' + processes_scan: 'yes' + hotfixes_scan: 'yes' + max_eps: 10 diff --git a/tests/integration/test_syscollector/test_syscollector_configuration.py b/tests/integration/test_syscollector/test_syscollector_configuration.py new file mode 100644 index 0000000000..fe1224df06 --- /dev/null +++ b/tests/integration/test_syscollector/test_syscollector_configuration.py @@ -0,0 +1,446 @@ +''' +copyright: Copyright (C) 2015-2023, Wazuh Inc. + + Created by Wazuh, Inc. . + + This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 + +type: integration + +brief: Wazuh gathers information about the agent system (OS, hardware, packages, etc.) periodically in a DB and sends + it to the manager, which finally stores this information in a DB. These tests check the different syscollector + configurations and the complete scan process. + +components: + - modulesd + +suite: syscollector + +targets: + - manager + - agent + +daemons: + - wazuh-modulesd + - wazuh-analysisd + - wazuh-db + +os_platform: + - linux + - windows + - macos + +os_version: + - CentOS 8 + - Ubuntu Bionic + - macOS Catalina + - Windows Server 2016 + - Windows Server 2019 + +references: + - https://documentation.wazuh.com/current/user-manual/capabilities/syscollector.html + - https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/wodle-syscollector.html +''' +import os +import sys + +import pytest +from wazuh_testing import ANALYSISD_DAEMON, DB_DAEMON, MODULES_DAEMON, LOG_FILE_PATH, T_10, T_60 +from wazuh_testing.modules import TIER0, SERVER, AGENT, LINUX, MACOS, WINDOWS +from wazuh_testing.tools import get_service +from wazuh_testing.tools.configuration import load_configuration_template, get_test_cases_data +from wazuh_testing.tools.monitoring import FileMonitor +from wazuh_testing.modules.syscollector import event_monitor as evm + + +# Marks +pytestmark = [TIER0, SERVER, AGENT, LINUX, MACOS, WINDOWS] + +# Reference paths +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, 'configuration') +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, 'test_cases') + +# Variables +local_internal_options = {'wazuh_modules.debug': 2} +if get_service() == 'wazuh-manager': + daemons_handler_configuration = {'daemons': [ANALYSISD_DAEMON, DB_DAEMON, MODULES_DAEMON], 'ignore_errors': True} +elif sys.platform == 'win32': + daemons_handler_configuration = {'all_daemons': True, 'ignore_errors': True} + local_internal_options = {'windows.debug': 2} +else: + daemons_handler_configuration = {'daemons': [MODULES_DAEMON], 'ignore_errors': True} + +# T1 Parameters: Check that Syscollector is disabled. +t1_config_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_syscollector.yaml') +t1_cases_path = os.path.join(TEST_CASES_PATH, 'case_test_syscollector_deactivation.yaml') +t1_config_parameters, t1_config_metadata, t1_case_ids = get_test_cases_data(t1_cases_path) +t1_configurations = load_configuration_template(t1_config_path, t1_config_parameters, t1_config_metadata) + +# T2 Parameters: Check that each scan is disabled. +t2_config_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_syscollector_scans_disabled.yaml') +t2_cases_path = os.path.join(TEST_CASES_PATH, 'case_test_all_scans_disabled.yaml') +t2_config_parameters, t2_config_metadata, t2_case_ids = get_test_cases_data(t2_cases_path) +t2_configurations = load_configuration_template(t2_config_path, t2_config_parameters, t2_config_metadata) + +# T3 Parameters: Check the behavior of Syscollector while setting invalid configurations. +t3_config_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_syscollector.yaml') +t3_cases_path = os.path.join(TEST_CASES_PATH, 'case_test_invalid_configurations.yaml') +t3_config_parameters, t3_config_metadata, t3_case_ids = get_test_cases_data(t3_cases_path) +t3_configurations = load_configuration_template(t3_config_path, t3_config_parameters, t3_config_metadata) + +# T4 Parameters: Check that Syscollector sets the default values when the configuration block is empty. +t4_config_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_syscollector_no_tags.yaml') +t4_cases_path = os.path.join(TEST_CASES_PATH, 'case_test_default_values.yaml') +t4_config_parameters, t4_config_metadata, t4_case_ids = get_test_cases_data(t4_cases_path) +t4_configurations = load_configuration_template(t4_config_path, t4_config_parameters, t4_config_metadata) + +# T5 Parameters: Check that the scan is completed when all scans are enabled. +t5_config_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_syscollector.yaml') +t5_cases_path = os.path.join(TEST_CASES_PATH, 'case_test_scanning.yaml') +t5_config_parameters, t5_config_metadata, t5_case_ids = get_test_cases_data(t5_cases_path) +t5_config_metadata = t5_config_parameters +t5_configurations = load_configuration_template(t5_config_path, t5_config_parameters, t5_config_metadata) + + +# Tests +@pytest.mark.parametrize('configuration, metadata', zip(t1_configurations, t1_config_metadata), ids=t1_case_ids) +def test_syscollector_deactivation(configuration, metadata, set_wazuh_configuration, + configure_local_internal_options_module, truncate_monitored_files, + daemons_handler_function): + ''' + description: Check that syscollector is disabled. + + test_phases: + - setup: + - Set Syscollector configuration. + - Configure modulesd in debug mode. + - Truncate all the log files and json alerts files. + - Restart the necessary daemons for each test case. + - test: + - Check if Syscollector was disabled. + - teardown: + - Restore Wazuh configuration. + - Restore local internal options. + - Truncate all the log files and json alerts files. + - Stop the necessary daemons. + + wazuh_min_version: 4.4.0 + + tier: 0 + + parameters: + - configuration: + type: dict + brief: Configuration loaded from the template located in `configuration` folder. + - metadata: + type: dict + brief: Test case metadata. + - set_wazuh_configuration: + type: fixture + brief: Set wazuh configuration using the configuration template. + - configure_local_internal_options_module: + type: fixture + brief: Configure the local internal options file. + - truncate_monitored_files: + type: fixture + brief: Truncate all the log files and json alerts files before and after the test execution. + - daemons_handler_function: + type: fixture + brief: Handler of Wazuh daemons for each test case. + + assertions: + - Check if the syscollector module is disabled. + + input_description: + - The `configuration_syscollector.yaml` file provides the module configuration for this test. + - The `case_test_syscollector_deactivation.yaml` file provides the test cases. + ''' + file_monitor = FileMonitor(LOG_FILE_PATH) + evm.check_syscollector_is_disabled(file_monitor=file_monitor, timeout=T_10) + + +@pytest.mark.parametrize('configuration, metadata', zip(t2_configurations, t2_config_metadata), ids=t2_case_ids) +def test_syscollector_all_scans_disabled(configuration, metadata, set_wazuh_configuration, + configure_local_internal_options_module, truncate_monitored_files, + daemons_handler_function): + ''' + description: Check that each scan is disabled. + + test_phases: + - setup: + - Set Syscollector configuration. + - Configure modulesd in debug mode. + - Truncate all the log files and json alerts files. + - Restart the necessary daemons for each test case. + - test: + - Check that no scan is triggered. + - teardown: + - Restore Wazuh configuration. + - Restore local internal options. + - Truncate all the log files and json alerts files. + - Stop the necessary daemons. + + wazuh_min_version: 4.4.0 + + tier: 0 + + parameters: + - configuration: + type: dict + brief: Configuration loaded from the template located in `configuration` folder. + - metadata: + type: dict + brief: Test case metadata. + - set_wazuh_configuration: + type: fixture + brief: Set wazuh configuration using the configuration template. + - configure_local_internal_options_module: + type: fixture + brief: Configure the local internal options file. + - truncate_monitored_files: + type: fixture + brief: Truncate the log file before and after the test execution. + - daemons_handler_function: + type: fixture + brief: Handler of Wazuh daemons for each test case. + + assertions: + - Check if a specific scan is disabled and not triggered. + + input_description: + - The `configuration_syscollector_scans_disabled.yaml` file provides the module configuration for this test. + - The `case_test_all_scans_disabled.yaml` file provides the test cases. + ''' + check_functions = [evm.check_hardware_scan_started, evm.check_os_scan_started, evm.check_network_scan_started, + evm.check_packages_scan_started, evm.check_ports_scan_started, evm.check_processes_scan_started] + # Add the hotfixes check if the platform is Windows. + if sys.platform == 'win32': + check_functions.append(evm.check_hotfixes_scan_started) + + # Check that no scan is triggered. + for check_function in check_functions: + # Expected: the function must throw a TimeoutError + with pytest.raises(TimeoutError): + file_monitor = FileMonitor(LOG_FILE_PATH) + # Is not necessary to set the update_position to False because the Syscollector is configured to run its + # scan every 2 seconds in `case_test_all_scans_disabled.yaml` + check_function(file_monitor=file_monitor) + pytest.fail('It seems that a scan was triggered.' + f"This check has a match in the log: {check_function.__name__}") + + +@pytest.mark.parametrize('configuration, metadata', zip(t3_configurations, t3_config_metadata), ids=t3_case_ids) +def test_syscollector_invalid_configurations(configuration, metadata, set_wazuh_configuration, + configure_local_internal_options_module, truncate_monitored_files, + daemons_handler_function): + ''' + description: Check the behavior of Syscollector while setting invalid configurations. + + test_phases: + - setup: + - Set Syscollector configuration. + - Configure modulesd in debug mode. + - Truncate all the log files and json alerts files. + - Restart the necessary daemons for each test case. + - test: + - Skip test if the field is hotfixes and the platform is not Windows. + - Check if the tag/attribute error is present in the logs. + - Check if Syscollector starts depending on the criticality of the field. + - teardown: + - Restore Wazuh configuration. + - Restore local internal options. + - Truncate all the log files and json alerts files. + - Stop the necessary daemons. + + wazuh_min_version: 4.4.0 + + tier: 0 + + parameters: + - configuration: + type: dict + brief: Configuration loaded from the template located in `configuration` folder. + - metadata: + type: dict + brief: Test case metadata. + - set_wazuh_configuration: + type: fixture + brief: Set wazuh configuration using the configuration template. + - configure_local_internal_options_module: + type: fixture + brief: Configure the local internal options file. + - truncate_monitored_files: + type: fixture + brief: Truncate the log file before and after the test execution. + - daemons_handler_function: + type: fixture + brief: Handler of Wazuh daemons for each test case. + + assertions: + - Check if the scan is triggered after N seconds. + - Check if a specific scan is disabled and not triggered. + + input_description: + - The `configuration_syscollector.yaml` file provides the module configuration for this test. + - The `case_test_invalid_configurations.yaml` file provides the test cases. + ''' + field = metadata['field'] + attribute = metadata['attribute'] + non_critical_fields = ('max_eps') + file_monitor = FileMonitor(LOG_FILE_PATH) + + # Skip test if the field is hotfixes and the platform is not Windows. + if field == 'hotfixes' and sys.platform != 'win32': + pytest.skip('The hotfixes scan is exclusive of Windows agents.') + + # If the field has no value, it means that the test should search for the attribute error in the logs, not for the + # tag error. + if field is not None: + evm.check_tag_error(file_monitor=file_monitor, field=field) + # Check that the module has started if the field is not critical + if field in non_critical_fields: + file_monitor = FileMonitor(LOG_FILE_PATH) + evm.check_module_is_starting(file_monitor=file_monitor) + else: + evm.check_attr_error(file_monitor=file_monitor, attr=attribute) + + # Check that the module does not start if the field is critical + with pytest.raises(TimeoutError): + evm.check_module_is_starting(file_monitor=file_monitor) + pytest.fail(f"The module has started anyway. This behavior is not the expected.") + + +@pytest.mark.parametrize('configuration, metadata', zip(t4_configurations, t4_config_metadata), ids=t4_case_ids) +@pytest.mark.xfail(reason='Reported in wazuh/wazuh#15413 - To be removed in 4.5: wazuh/wazuh-qa#3798') +def test_syscollector_default_values(configuration, metadata, set_wazuh_configuration, + configure_local_internal_options_module, truncate_monitored_files, + daemons_handler_function): + ''' + description: Check that Syscollector sets the default values when the configuration block is empty. + + test_phases: + - setup: + - Set Syscollector configuration. + - Configure modulesd in debug mode. + - Truncate all the log files and json alerts files. + - Restart the necessary daemons for each test case. + - test: + - Check if the default configuration was applied. + - Check if Syscollector starts correctly. + - teardown: + - Restore Wazuh configuration. + - Restore local internal options. + - Truncate all the log files and json alerts files. + - Stop the necessary daemons. + + wazuh_min_version: 4.4.0 + + tier: 0 + + parameters: + - configuration: + type: dict + brief: Configuration loaded from the template located in `configuration` folder. + - metadata: + type: dict + brief: Test case metadata. + - set_wazuh_configuration: + type: fixture + brief: Set wazuh configuration using the configuration template. + - configure_local_internal_options_module: + type: fixture + brief: Configure the local internal options file. + - truncate_monitored_files: + type: fixture + brief: Truncate the log file before and after the test execution. + - daemons_handler_function: + type: fixture + brief: Handler of Wazuh daemons for each test case. + + assertions: + - Check if the module sets the default configuration. + + input_description: + - The `configuration_syscollector_no_tags.yaml` file provides the module configuration for this test. + - The `case_test_default_values.yaml` file provides the test cases. + ''' + file_monitor = FileMonitor(LOG_FILE_PATH) + evm.check_config(file_monitor=file_monitor) + evm.check_module_startup_finished(file_monitor=file_monitor) + + +@pytest.mark.parametrize('configuration, metadata', zip(t5_configurations, t5_config_metadata), ids=t5_case_ids) +def test_syscollector_scanning(configuration, metadata, set_wazuh_configuration, + configure_local_internal_options_module, truncate_monitored_files, + daemons_handler_function): + ''' + description: Check that the scan is completed when all scans are enabled. + + test_phases: + - setup: + - Set Syscollector configuration. + - Configure modulesd in debug mode. + - Truncate all the log files and json alerts files. + - Restart the necessary daemons for each test case. + - test: + - Check if the default configuration was applied. + - Check if Syscollector starts correctly. + - teardown: + - Restore Wazuh configuration. + - Restore local internal options. + - Truncate all the log files and json alerts files. + - Stop the necessary daemons. + + wazuh_min_version: 4.4.0 + + tier: 0 + + parameters: + - configuration: + type: dict + brief: Configuration loaded from the template located in `configuration` folder. + - metadata: + type: dict + brief: Test case metadata. + - set_wazuh_configuration: + type: fixture + brief: Set wazuh configuration using the configuration template. + - configure_local_internal_options_module: + type: fixture + brief: Configure the local internal options file. + - truncate_monitored_files: + type: fixture + brief: Truncate the log file before and after the test execution. + - daemons_handler_function: + type: fixture + brief: Handler of Wazuh daemons for each test case. + + assertions: + - Check if each scan is completed. + - Check if the synchronization is completed. + + input_description: + - The `configuration_syscollector.yaml` file provides the module configuration for this test. + - The `case_test_scanning.yaml` file provides the test cases. + ''' + file_monitor = FileMonitor(LOG_FILE_PATH) + # 60s + 2 seconds of margin because it includes the case when the agent starts for the first time + evm.check_module_is_starting(file_monitor=file_monitor, timeout=T_60 + 2) + # Check general scan has started + evm.check_scan_started(file_monitor=file_monitor, timeout=T_10) + + # Check that each scan was accomplished + checks_to_run = [evm.check_hardware_scan_finished, evm.check_os_scan_finished, evm.check_network_scan_finished, + evm.check_packages_scan_finished, evm.check_ports_scan_finished, evm.check_processes_scan_finished] + if sys.platform == 'win32': + checks_to_run.append(evm.check_hotfixes_scan_finished) + + for check_runner in checks_to_run: + # Run check + check_runner(file_monitor=file_monitor, timeout=T_10) + + # Check general scan has finished + evm.check_scan_finished(file_monitor=file_monitor, timeout=T_10) + # Check that the sync has finished + evm.check_sync_finished(file_monitor=file_monitor, timeout=T_10) From 680487c2bf408640960dde14d555dc0dc511a750 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mauro=20Agust=C3=ADn=20Malara=20Zapata?= <39094716+mauromalara@users.noreply.github.com> Date: Wed, 19 Apr 2023 11:03:24 +0200 Subject: [PATCH 20/34] fix(#4105): fix a bug when running tests for the first time --- CHANGELOG.md | 1 + .../wazuh_testing/tools/migration_tool/utils.py | 10 ++++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c2ede1e2b5..dbcf4bb92b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -34,6 +34,7 @@ Release report: TBD ### Fixed +- Fix a bug in on Migration tool's library ([#4106](https://github.com/wazuh/wazuh-qa/pull/4106)) \- (Framework) - Fix imports and add windows support for test_report_changes_and_diff IT ([#3548](https://github.com/wazuh/wazuh-qa/issues/3548)) \- (Framework + Tests) - Fix a regex error in the FIM integration tests ([#3061](https://github.com/wazuh/wazuh-qa/issues/3061)) \- (Framework + Tests) - Fix an error in the cluster performance tests related to CSV parser ([#2999](https://github.com/wazuh/wazuh-qa/pull/2999)) \- (Framework + Tests) diff --git a/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py b/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py index 0394aebdb5..8d73e6f013 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py +++ b/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py @@ -6,19 +6,21 @@ import glob import json import os -import subprocess as sbp - import mysql.connector +import subprocess as sbp from jsonschema import validate from jsonschema.exceptions import ValidationError from mysql.connector import errorcode + from wazuh_testing.tools.migration_tool import MIGRATION_TOOL_PATH, CVE5_SCHEMA_PATH, DELTA_SCHEMA_PATH, \ ERROR_MESSAGES, SNAPSHOTS_DIR, DOWNLOADS_DIR, MIGRATION_TOOL_LOG_PATH, \ MYSQL_CREDENTIALS, UNCOMPRESSED_DIR from wazuh_testing.tools.file import delete_all_files_in_folder, read_json_file, truncate_file from wazuh_testing.tools.logging import Logging + logger = Logging('migration_tool') +vendors = ('alas', 'arch', 'almalinux', 'canonical', 'cve', 'debian', 'nvd', 'redhat', 'suse') def run_content_migration_tool(args='', config_files=None): @@ -174,9 +176,9 @@ def clean_migration_tool_output_files(): '''Remove all files generated by Content Migration Tool. ''' output_folders = [SNAPSHOTS_DIR, DOWNLOADS_DIR, UNCOMPRESSED_DIR] - vendors_folders = os.listdir(SNAPSHOTS_DIR) + for output_folder in output_folders: - for folder in vendors_folders: + for folder in vendors: folder = os.path.join(output_folder, folder) if os.path.exists(folder): delete_all_files_in_folder(folder) From 7da4e3656bb1786d9e938399e02e483b8ac3efc3 Mon Sep 17 00:00:00 2001 From: Kevin Ledesma <44633633+QU3B1M@users.noreply.github.com> Date: Fri, 21 Apr 2023 17:45:45 +0200 Subject: [PATCH 21/34] fix(#4082): updated log severity * fix(#4082): updated log severity * docs(#4082): update CHANGELOG --- CHANGELOG.md | 1 + .../test_configuration/test_basic_configuration_log_format.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dbcf4bb92b..d5db97fc86 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,7 @@ Release report: TBD ### Changed +- Update `test_logcollector` invalid configs log level ([#4094](https://github.com/wazuh/wazuh-qa/pull/4094)) \- (Tests) - Update `test_office365` to support the new tag `API_TYPE` ([#4065](https://github.com/wazuh/wazuh-qa/pull/4065)) \- (Framework + Tests) - Update `test_wazuh_db` & `test_enrollment` to support new column `status_code` and new value on the enrollment `payload`. ([#4021](https://github.com/wazuh/wazuh-qa/pull/4021)) \- (Tests) - Update FIM `test_audit` tests to new framework ([#3939](https://github.com/wazuh/wazuh-qa/pull/3939)) \- (Framework + Tests) diff --git a/tests/integration/test_logcollector/test_configuration/test_basic_configuration_log_format.py b/tests/integration/test_logcollector/test_configuration/test_basic_configuration_log_format.py index 97a32825ce..80e5d5dce4 100644 --- a/tests/integration/test_logcollector/test_configuration/test_basic_configuration_log_format.py +++ b/tests/integration/test_logcollector/test_configuration/test_basic_configuration_log_format.py @@ -274,7 +274,7 @@ def check_log_format_invalid(cfg): error_message=gc.GENERIC_CALLBACK_ERROR_MESSAGE) if sys.platform != 'win32': - log_callback = gc.callback_error_in_configuration('CRITICAL', prefix, + log_callback = gc.callback_error_in_configuration('ERROR', prefix, conf_path=f'{wazuh_configuration}') wazuh_log_monitor.start(timeout=5, callback=log_callback, error_message=gc.GENERIC_CALLBACK_ERROR_MESSAGE) From c440043df03aa7032247ea83b20627a657f9c05d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9s=20Carmelo=20Micalizzi=20Casali?= Date: Mon, 24 Apr 2023 11:00:14 -0300 Subject: [PATCH 22/34] feat(#3361): add MSU Catalog Patches IT * feat(#3361): add database query function * feat(#3361): add new test module and cases * style(#3361): fix yaml styling * style(#3361): fix spacing and whitespaces * docs(#3361): update changelog * docs(#3361): add clarifying comment * style(#3361): remove whitespace * style(#3361): fix style and docu --- CHANGELOG.md | 1 + .../wazuh_testing/db_interface/cve_db.py | 24 +++ .../wazuh_testing/modules/fim/classes.py | 2 +- .../configuration_msu_inventory.yaml | 47 ++++++ .../data/test_cases/cases_msu_inventory.yaml | 8 + .../test_feeds/test_msu_inventory.py | 154 ++++++++++++++++++ 6 files changed, 235 insertions(+), 1 deletion(-) create mode 100644 tests/integration/test_vulnerability_detector/test_feeds/data/configuration_template/configuration_msu_inventory.yaml create mode 100644 tests/integration/test_vulnerability_detector/test_feeds/data/test_cases/cases_msu_inventory.yaml create mode 100644 tests/integration/test_vulnerability_detector/test_feeds/test_msu_inventory.py diff --git a/CHANGELOG.md b/CHANGELOG.md index d5db97fc86..dfd57373f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ Release report: TBD ### Added +- Add tests for msu patches with no associated CVE . ([#4009](https://github.com/wazuh/wazuh-qa/pull/4009)) \- (Framework + Tests) - Add tests with new options to avoid FIM synchronization overlapping. ([#3318](https://github.com/wazuh/wazuh-qa/pull/3318)) \- (Framework + tests) - Add Logcollector millisecond granularity support test case ([#3910](https://github.com/wazuh/wazuh-qa/pull/3910)) \- (Tests) - Add Windows System folders FIM monitoring tests ([#3720](https://github.com/wazuh/wazuh-qa/pull/3720)) \- (Tests) diff --git a/deps/wazuh_testing/wazuh_testing/db_interface/cve_db.py b/deps/wazuh_testing/wazuh_testing/db_interface/cve_db.py index 750f8c53b8..45603c37fc 100644 --- a/deps/wazuh_testing/wazuh_testing/db_interface/cve_db.py +++ b/deps/wazuh_testing/wazuh_testing/db_interface/cve_db.py @@ -228,3 +228,27 @@ def get_nvd_metadata_timestamp(year): return None return result[0] + + +def get_rows_from_table(value, column, table, limit=None): + """ + Args: + value (str): value that user wants to find in query + column (str): Name of the column where the value will be searched for. + table (str): Name of the table where the value will be searched for. + limit (int) - Optional: Maximum amount of results to look for. Default None (No Limit used). + + Returns: + List (str): List with each instance of the value found + """ + + query_string = f"SELECT * FROM {table} WHERE {column} LIKE '{value}'" + + if limit is not None: + query_string = query_string + f"LIMIT {limit}" + + result = get_sqlite_query_result(CVE_DB_PATH, query_string) + if len(result) == 0: + return None + + return result[0] diff --git a/deps/wazuh_testing/wazuh_testing/modules/fim/classes.py b/deps/wazuh_testing/wazuh_testing/modules/fim/classes.py index b35293735f..06b734fd6f 100644 --- a/deps/wazuh_testing/wazuh_testing/modules/fim/classes.py +++ b/deps/wazuh_testing/wazuh_testing/modules/fim/classes.py @@ -460,7 +460,7 @@ def validate_checkers_per_event(events, options, mode): if self.is_value: validate_registry_event(ev, options, mode, is_key=False) else: - validate_registry_event(ev, options, mode , is_key=False) + validate_registry_event(ev, options, mode, is_key=True) def check_events_type(events, ev_type, reg_list=['testkey0']): """Checks the event type of each events in a list. diff --git a/tests/integration/test_vulnerability_detector/test_feeds/data/configuration_template/configuration_msu_inventory.yaml b/tests/integration/test_vulnerability_detector/test_feeds/data/configuration_template/configuration_msu_inventory.yaml new file mode 100644 index 0000000000..4ad1fa6eb2 --- /dev/null +++ b/tests/integration/test_vulnerability_detector/test_feeds/data/configuration_template/configuration_msu_inventory.yaml @@ -0,0 +1,47 @@ +- sections: + - section: vulnerability-detector + elements: + - enabled: + value: 'yes' + - run_on_start: + value: 'yes' + - provider: + attributes: + - name: PROVIDER + elements: + - enabled: + value: 'yes' + - os: + value: OS + + - section: sca + elements: + - enabled: + value: 'no' + + - section: rootcheck + elements: + - disabled: + value: 'yes' + + - section: syscheck + elements: + - disabled: + value: 'yes' + + - section: wodle + attributes: + - name: syscollector + elements: + - disabled: + value: 'yes' + + - section: auth + elements: + - disabled: + value: 'yes' + + - section: rule_test + elements: + - enabled: + value: 'no' diff --git a/tests/integration/test_vulnerability_detector/test_feeds/data/test_cases/cases_msu_inventory.yaml b/tests/integration/test_vulnerability_detector/test_feeds/data/test_cases/cases_msu_inventory.yaml new file mode 100644 index 0000000000..db48d15f07 --- /dev/null +++ b/tests/integration/test_vulnerability_detector/test_feeds/data/test_cases/cases_msu_inventory.yaml @@ -0,0 +1,8 @@ +- name: check_patches_with_no_cve_present + description: Test patches with no associated CVE are added from the catalog + configuration_parameters: + PROVIDER: msu + OS: '' + metadata: + provider_name: Microsoft Security Update + download_timeout: 120 diff --git a/tests/integration/test_vulnerability_detector/test_feeds/test_msu_inventory.py b/tests/integration/test_vulnerability_detector/test_feeds/test_msu_inventory.py new file mode 100644 index 0000000000..ca955bc3b7 --- /dev/null +++ b/tests/integration/test_vulnerability_detector/test_feeds/test_msu_inventory.py @@ -0,0 +1,154 @@ +''' +copyright: Copyright (C) 2015-2023, Wazuh Inc. + + Created by Wazuh, Inc. . + + This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 + +type: integration + +brief: Wazuh is able to detect vulnerabilities in the applications installed in agents using the Vulnerability Detector + module. This software audit is performed through the integration of vulnerability feeds indexed by Redhat, + Canonical, Debian, Amazon Linux and NVD Database. + +components: + - vulnerability_detector + +suite: feeds + +targets: + - manager + +daemons: + - wazuh-modulesd + - wazuh-db + - wazuh-analysisd + +os_platform: + - linux + +os_version: + - Arch Linux + - Amazon Linux 2022 + - Amazon Linux 2 + - Amazon Linux 1 + - CentOS 8 + - CentOS 7 + - Debian Buster + - Red Hat 8 + - Ubuntu Trusty + - Ubuntu Xenial + - Ubuntu Bionic + - Ubuntu Focal + - Ubuntu Jammy + - SUSE Linux Enterprise Desktop 11 + - SUSE Linux Enterprise Desktop 12 + - SUSE Linux Enterprise Desktop 15 + - SUSE Linux Enterprise Server 11 + - SUSE Linux Enterprise Server 12 + - SUSE Linux Enterprise Server 15 + +references: + - https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/ + - https://documentation.wazuh.com/current/user-manual/capabilities/syscollector.html + +tags: + - vulnerability + - vulnerability_detector + - download + - feeds +''' +import os +import pytest + +from wazuh_testing.db_interface.cve_db import get_rows_from_table +from wazuh_testing.tools.configuration import load_configuration_template, get_test_cases_data +from wazuh_testing.modules.vulnerability_detector import event_monitor as evm + + +# Reference paths +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, 'configuration_template') +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, 'test_cases') + +# Configuration and cases data +configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_msu_inventory.yaml') +cases_path = os.path.join(TEST_CASES_PATH, 'cases_msu_inventory.yaml') + +# Test configurations +configuration_parameters, configuration_metadata, case_ids = get_test_cases_data(cases_path) +configurations = load_configuration_template(configurations_path, configuration_parameters, configuration_metadata) + +# Variables +# This patches are searched for to verify they are added correctly from the Catalog even if not associated to a CVE +patch_references = ['4465477', '5003711', '4470788'] + + +@pytest.mark.tier(level=2) +@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=case_ids) +def test_msu_catalog_patches(configuration, metadata, set_wazuh_configuration_vdt, truncate_monitored_files, + clean_cve_tables_func, restart_modulesd_function): + ''' + description: Check that patch information is added to the feed from the catalog for patches not directly related + to a Vulnerability. + + test_phases: + Setup: + - Set a custom Wazuh configuration. + - Restart wazuh-modulesd. + Test: + - Check in log that the database provider has been updated successfully. + - Query the DB to check patch is found in MSU_SUPERSEDENSE table + - Query the DB to check patch is not found in MSU table (has no Vulnerability linked to it). + Teardown: + - Clean the database. + - Stop wazuh-modulesd. + + wazuh_min_version: 4.5.0 + + tier: 2 + + parameters: + - configuration: + type: dict + brief: Wazuh configuration data. Needed for set_wazuh_configuration fixture. + - metadata: + type: dict + brief: Wazuh configuration metadata + - set_wazuh_configuration_vdt: + type: fixture + brief: Set the wazuh configuration according to the configuration data. + - truncate_monitored_files: + type: fixture + brief: Truncate all the log files and json alerts files before and after the test execution. + - clean_cve_tables_func: + type: fixture + brief: Clean all the CVE tables before and after running the test. + - restart_modulesd_function: + type: fixture + brief: Restart the wazuh-modulesd daemon. + + assertions: + - Check that the feed is downloaded successfully. + - Check that the referenced patch is found in MSU_SUPERSEDENSE table + - Check that the referenced patch is not foundin MSU table (has no Vulnerability linked to it). + + input_description: + - The `configuration_msu_inventory.yaml` file provides the module configuration for this test. + - The `cases_msu_inventory.yaml` file provides the test cases. + + expected_output: + - r'The update of the .* feed finished successfully' + ''' + # Check that the feed has been updated successfully + evm.check_provider_database_update_finish_log(provider_name=metadata['provider_name'], + timeout=metadata['download_timeout']) + + for patch in patch_references: + # Check that patch is present in MSU_SUPERSEDENCE table + patch_found = get_rows_from_table(patch, 'patch', 'MSU_SUPERSEDENCE') + assert patch_found is not None, f"The Expected data for KB{patch} was not found in MSU_SUPERSEDENCE Table" + + # Check that patch is not present in MSU table + patch_in_table = get_rows_from_table(patch, 'patch', 'MSU') + assert patch_in_table is None, f"Unexpected data found for KB{patch} in MSU Table" From 0654a55a723114ed076bd4fc255438e7e7054305 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Fri, 28 Apr 2023 12:51:21 +0100 Subject: [PATCH 23/34] fix(#4111): fix WazuhDB IT * fix(#4111): make_callback function * fix(#4111): typo in set agent groups tcases * fix(#4111): stop agent simulator after test end * docs(#4111): update changelog --- CHANGELOG.md | 1 + deps/wazuh_testing/wazuh_testing/event_monitor.py | 2 +- .../test_wazuh_db/data/global/set_agent_groups.yaml | 4 ++-- .../integration/test_wazuh_db/test_agent_database_version.py | 3 +++ 4 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1346efa630..fb92ade1cf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ All notable changes to this project will be documented in this file. ### Fixed +- Fix wazuhdb IT. ([#3584](https://github.com/wazuh/wazuh-qa/pull/3584)) \- (Framework + Tests) - Fix agentd IT for python3.10 AMI ([#3973](https://github.com/wazuh/wazuh-qa/pull/3973)) \- (Tests) - Fix unstable system tests ([#4080](https://github.com/wazuh/wazuh-qa/pull/4080)) \- (Tests) diff --git a/deps/wazuh_testing/wazuh_testing/event_monitor.py b/deps/wazuh_testing/wazuh_testing/event_monitor.py index 25abc72452..b52bc6b8fd 100644 --- a/deps/wazuh_testing/wazuh_testing/event_monitor.py +++ b/deps/wazuh_testing/wazuh_testing/event_monitor.py @@ -14,7 +14,7 @@ def make_callback(pattern, prefix=''): lambda: function that returns if there's a match in the file """ pattern = r'\s+'.join(pattern.split()) - regex = re.compile(r'{}{}'.format(prefix, pattern)) + regex = re.compile(r'{}{}'.format(prefix, pattern)) if prefix else re.compile(pattern) return lambda line: regex.match(line) diff --git a/tests/integration/test_wazuh_db/data/global/set_agent_groups.yaml b/tests/integration/test_wazuh_db/data/global/set_agent_groups.yaml index 22b8c84297..368592bb08 100644 --- a/tests/integration/test_wazuh_db/data/global/set_agent_groups.yaml +++ b/tests/integration/test_wazuh_db/data/global/set_agent_groups.yaml @@ -281,7 +281,7 @@ output: err An error occurred during the set of the groups agent_id: 27 expected_group: None - expected_warint: ".*WARNING: Invalid group name. 'Test,Group1' contains invalid characters" + expected_warning: ".*WARNING: Invalid group name. 'Test,Group1' contains invalid characters" expected_group_sync_status: synced - name: Wrong group name format - Assign a group with an invalid group name (has invalid '@' character) - Warning @@ -301,7 +301,7 @@ output: err An error occurred during the set of the groups agent_id: 29 expected_group: None - expected_warint: ".*WARNING: Invalid group name. '.' represents the current directory in unix systems" + expected_warning: ".*WARNING: Invalid group name. '.' represents the current directory in unix systems" expected_group_sync_status: synced - name: Wrong group name format - Assign a group with an invalid group name (..) - Warning diff --git a/tests/integration/test_wazuh_db/test_agent_database_version.py b/tests/integration/test_wazuh_db/test_agent_database_version.py index 41d773ec0c..9a0e9a4512 100644 --- a/tests/integration/test_wazuh_db/test_agent_database_version.py +++ b/tests/integration/test_wazuh_db/test_agent_database_version.py @@ -63,3 +63,6 @@ def test_agent_database_version(restart_wazuh_daemon, remove_agents): assert agent_version == expected_database_version, 'The agent database version is not the expected one. \n' \ f'Expected version: {expected_database_version}\n'\ f'Obtained version: {agent_version}' + + for agent in agents: + agent.stop_receiver() From 9b84104212513600b080b7b9f0b1943aede8c2a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mauro=20Agust=C3=ADn=20Malara=20Zapata?= <39094716+mauromalara@users.noreply.github.com> Date: Fri, 28 Apr 2023 11:07:44 -0300 Subject: [PATCH 24/34] fix(#4123): fix gcloud tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(#4123): fix daemons_handler fixture. * fix(#4123): remove some analysisd on test_gcloud * fix(#4123): change test_logging fixtures to module * fix(#4123): start analysisd in test max messages * docs(#4123): add fix to CHANGELOG. --------- Co-authored-by: jnasselle Co-authored-by: Víctor Rebollo Pérez --- CHANGELOG.md | 1 + tests/integration/conftest.py | 3 ++- tests/integration/test_gcloud/conftest.py | 4 +++- .../test_configuration/test_invalid.py | 1 - .../test_remote_configuration.py | 1 - .../test_configuration/test_schedule.py | 1 - .../test_functionality/test_day_wday.py | 1 - .../test_functionality/test_interval.py | 1 - .../test_functionality/test_logging.py | 19 +++++++++---------- .../test_functionality/test_max_messages.py | 9 +++++++-- .../test_functionality/test_pull_on_start.py | 1 - 11 files changed, 22 insertions(+), 20 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fb92ade1cf..d6d9c8db2e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ All notable changes to this project will be documented in this file. ### Fixed +- Fix daemons_handler fixture (fix GCP IT) ([#4134](https://github.com/wazuh/wazuh-qa/pull/4134)) \- (Tests) - Fix wazuhdb IT. ([#3584](https://github.com/wazuh/wazuh-qa/pull/3584)) \- (Framework + Tests) - Fix agentd IT for python3.10 AMI ([#3973](https://github.com/wazuh/wazuh-qa/pull/3973)) \- (Tests) - Fix unstable system tests ([#4080](https://github.com/wazuh/wazuh-qa/pull/4080)) \- (Tests) diff --git a/tests/integration/conftest.py b/tests/integration/conftest.py index 91116963fd..aa42dd8afe 100644 --- a/tests/integration/conftest.py +++ b/tests/integration/conftest.py @@ -904,7 +904,7 @@ def create_file_structure_function(get_files_list): @pytest.fixture(scope='module') -def daemons_handler(request): +def daemons_handler(get_configuration, request): """Handler of Wazuh daemons. It uses `daemons_handler_configuration` of each module in order to configure the behavior of the fixture. @@ -916,6 +916,7 @@ def daemons_handler(request): in order to use this fixture along with invalid configuration. Default `False` Args: + get_configuration (fixture): Get configurations from the module. Allows this fixture to be used for each param. request (fixture): Provide information on the executing test function. """ daemons = [] diff --git a/tests/integration/test_gcloud/conftest.py b/tests/integration/test_gcloud/conftest.py index d51c1494f9..caad609e06 100644 --- a/tests/integration/test_gcloud/conftest.py +++ b/tests/integration/test_gcloud/conftest.py @@ -11,6 +11,7 @@ from wazuh_testing.gcloud import detect_gcp_start, publish_sync import wazuh_testing.tools.configuration as conf + @pytest.fixture(scope='session', autouse=True) def handle_credentials_file(): if global_parameters.gcp_credentials is None or global_parameters.gcp_credentials_file is None: @@ -50,10 +51,11 @@ def wait_for_gcp_start(get_configuration, request): file_monitor = getattr(request.module, 'wazuh_log_monitor') detect_gcp_start(file_monitor) + @pytest.fixture(scope="session", autouse=True) def configure_internal_options(): local_internal_options = {'wazuh_modules.debug': 2, 'analysisd.debug': 2, 'monitord.rotate_log': 0, 'monitord.day_wait': 0, 'monitord.keep_log_days': 0,'monitord.size_rotate': 0} conf.set_local_internal_options_dict(local_internal_options) yield local_internal_options = {'wazuh_modules.debug': 0, 'analysisd.debug': 0, "monitord.rotate_log": 1, "monitord.day_wait": 10, "monitord.keep_log_days": 31,'monitord.size_rotate': 512} - conf.set_local_internal_options_dict(local_internal_options) \ No newline at end of file + conf.set_local_internal_options_dict(local_internal_options) diff --git a/tests/integration/test_gcloud/test_configuration/test_invalid.py b/tests/integration/test_gcloud/test_configuration/test_invalid.py index cdcee3a31a..eb9ec95cff 100644 --- a/tests/integration/test_gcloud/test_configuration/test_invalid.py +++ b/tests/integration/test_gcloud/test_configuration/test_invalid.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd diff --git a/tests/integration/test_gcloud/test_configuration/test_remote_configuration.py b/tests/integration/test_gcloud/test_configuration/test_remote_configuration.py index 30057e3a9f..2d076bb99c 100644 --- a/tests/integration/test_gcloud/test_configuration/test_remote_configuration.py +++ b/tests/integration/test_gcloud/test_configuration/test_remote_configuration.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd diff --git a/tests/integration/test_gcloud/test_configuration/test_schedule.py b/tests/integration/test_gcloud/test_configuration/test_schedule.py index 4849be435b..166e468f8a 100644 --- a/tests/integration/test_gcloud/test_configuration/test_schedule.py +++ b/tests/integration/test_gcloud/test_configuration/test_schedule.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd diff --git a/tests/integration/test_gcloud/test_functionality/test_day_wday.py b/tests/integration/test_gcloud/test_functionality/test_day_wday.py index 894124fbfb..a84e45ca45 100644 --- a/tests/integration/test_gcloud/test_functionality/test_day_wday.py +++ b/tests/integration/test_gcloud/test_functionality/test_day_wday.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd diff --git a/tests/integration/test_gcloud/test_functionality/test_interval.py b/tests/integration/test_gcloud/test_functionality/test_interval.py index 72d725d43c..c239bcf048 100644 --- a/tests/integration/test_gcloud/test_functionality/test_interval.py +++ b/tests/integration/test_gcloud/test_functionality/test_interval.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd diff --git a/tests/integration/test_gcloud/test_functionality/test_logging.py b/tests/integration/test_gcloud/test_functionality/test_logging.py index ac47ac92e1..92f9f5a291 100644 --- a/tests/integration/test_gcloud/test_functionality/test_logging.py +++ b/tests/integration/test_gcloud/test_functionality/test_logging.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd @@ -76,7 +75,7 @@ # configurations -daemons_handler_configuration = {'daemons': ['wazuh-analysisd', 'wazuh-modulesd']} +daemons_handler_configuration = {'daemons': ['wazuh-modulesd']} monitoring_modes = ['scheduled'] conf_params = {'PROJECT_ID': global_parameters.gcp_project_id, 'SUBSCRIPTION_NAME': global_parameters.gcp_subscription_name, @@ -94,14 +93,14 @@ # fixtures -@pytest.fixture(scope='package', params= [ - {'wazuh_modules.debug': 0, 'analysisd.debug': 2, +@pytest.fixture(scope='module', params= [ + {'wazuh_modules.debug': 0, 'monitord.rotate_log': 0, 'monitord.day_wait': 0, 'monitord.keep_log_days': 0, 'monitord.size_rotate': 0}, - {'wazuh_modules.debug': 1, 'analysisd.debug': 2, + {'wazuh_modules.debug': 1, 'monitord.rotate_log': 0, 'monitord.day_wait': 0, 'monitord.keep_log_days': 0, 'monitord.size_rotate': 0}, - {'wazuh_modules.debug': 2, 'analysisd.debug': 2, + {'wazuh_modules.debug': 2, 'monitord.rotate_log': 0, 'monitord.day_wait': 0, 'monitord.keep_log_days': 0, 'monitord.size_rotate': 0} ]) @@ -110,8 +109,8 @@ def get_local_internal_options(request): return request.param -@pytest.fixture(scope='package') -def configure_local_internal_options_package(get_local_internal_options): +@pytest.fixture(scope='module') +def configure_local_internal_options_module(get_local_internal_options): """Fixture to configure the local internal options file. It uses the test fixture get_local_internal_options. This should be @@ -145,7 +144,7 @@ def get_configuration(request): (['{level} GCP'.format(level=log_level) for log_level in log_levels]), ], indirect=True) def test_logging(get_configuration, configure_environment, reset_ossec_log, - publish_messages, configure_local_internal_options_package, + publish_messages, configure_local_internal_options_module, daemons_handler, wait_for_gcp_start): ''' description: Check if the 'gcp-pubsub' module generates logs according to the debug level set for wazuh_modules. @@ -167,7 +166,7 @@ def test_logging(get_configuration, configure_environment, reset_ossec_log, - publish_messages: type: list brief: List of testing GCP logs. - - configure_local_internal_options_package: + - configure_local_internal_options_module: type: fixture brief: Fixture to modify the local_internal_options.conf file and restart modulesd. diff --git a/tests/integration/test_gcloud/test_functionality/test_max_messages.py b/tests/integration/test_gcloud/test_functionality/test_max_messages.py index 5b9b539d33..5ca6ba1b2f 100644 --- a/tests/integration/test_gcloud/test_functionality/test_max_messages.py +++ b/tests/integration/test_gcloud/test_functionality/test_max_messages.py @@ -25,7 +25,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd @@ -62,6 +61,8 @@ from wazuh_testing.tools.configuration import load_wazuh_configurations from wazuh_testing.tools.monitoring import FileMonitor from wazuh_testing.tools.file import truncate_file +from wazuh_testing.tools import get_service + from google.cloud import pubsub_v1 # Marks @@ -82,7 +83,11 @@ # configurations -daemons_handler_configuration = {'daemons': ['wazuh-analysisd', 'wazuh-modulesd']} +if get_service() == 'wazuh-manager': + daemons_handler_configuration = {'daemons': ['wazuh-modulesd', 'wazuh-analysisd']} +else: + daemons_handler_configuration = {'daemons': ['wazuh-modulesd']} + monitoring_modes = ['scheduled'] conf_params = {'PROJECT_ID': global_parameters.gcp_project_id, 'SUBSCRIPTION_NAME': global_parameters.gcp_subscription_name, diff --git a/tests/integration/test_gcloud/test_functionality/test_pull_on_start.py b/tests/integration/test_gcloud/test_functionality/test_pull_on_start.py index dc7616bfb7..9175628aa6 100644 --- a/tests/integration/test_gcloud/test_functionality/test_pull_on_start.py +++ b/tests/integration/test_gcloud/test_functionality/test_pull_on_start.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd From 87a6bde0d391f1b483d0edf8d4615afbf5869f6e Mon Sep 17 00:00:00 2001 From: Nico Stefani Date: Fri, 28 Apr 2023 11:46:02 -0300 Subject: [PATCH 25/34] feat(#3333): add AWS integration tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat(#3333): Add basic structure for AWS tests * feat(#3335): Cloudtrail integration tests (#3624) * feat(#3335): add basic test for aws cloudtrail module * feat(#3335): add utils for handle files in S3 buckets * feat(#3335): add remove_from_bucket test for aws cloudtrail module * feat(#3335): add fixture for delete s3_cloudtrail.db * refactor(#3335): rename modules * refactor(#3335): change the return of upload_file function * refactor(#3335): Fix docstring and rename constant * refactor(#3335): improve default test catching parser and module errors * feat(#3335): add only_logs_from test for aws cloudtrail module * feat(#3335): add path tests for aws cloudtrail module * feat(#3335): add path_suffix tests for aws cloudtrail module * feat(#3335): add regions tests for aws cloudtrail module * refactor(#3335): Move wazuh_log_monitor to a fixture * feat(#3335): add discard_regex tests for aws cloudtrail module * feat(#3335): add only_logs_after tier_1 test for aws cloudtrail module * refactor(#3335): Improve name of test cases * refactor(#3335): Improve tests assertions * refactor(#3335): Improve tier 1 test * refactor(#3335): Implement new design for Tier 1 test * style(#3335): Changed the extension from .yml to .yaml * style(#3335): Fixed linter issues * style(#3335): Apply suggestions from code review Co-authored-by: José Luis López Sánchez * refactor(#3335): Add path parameter to get_db_connection * style(#3335): Fix quotes use according to QA style * style(#3335): Use google docstring style * refactor(#3335): Add missing information about fixtures * refactor(#3335): Change sqlite table name for backward compatibility * style(#3335): Fix docstrings punctuation and capitalization * refactor(#3335): Apply suggestions from code review * style(#3335): Apply suggestions from code review Fix punctuation in docstrings. Co-authored-by: David Jose Iglesias Lopez * style(#3335): Apply suggestions from code review Co-authored-by: David Jose Iglesias Lopez Co-authored-by: José Luis López Sánchez Co-authored-by: David Jose Iglesias Lopez * feat(#3336): VPC integration tests (#3699) * feat(#3336): Add basic test for aws vpc integration * feat(#3336): Add data generator for vpcflow type * feat(#3336): Add remove_from_bucket test for aws vpc integration * feat(#3336): Add only_logs_after tests for aws vpc integration * feat(#3336): Add path tests for aws vpc integration * feat(#3336): Add path_suffix tests for aws vpc integration * feat(#3336): Add regions tests for aws vpc integration * feat(#3336): Add discard_regex tests for aws vpc integration * feat(#3336): Add only_logs_after tier_1 tests for aws vpc integration * style(#3336): Fix linter issues * feat(#3336): Use join in path builds * feat(#3336): Fix cloudtrail cases * feat(#3336): Detect found and skipped logs * feat(#3336): Improve delete_file_from_s3 fixture * fix(#3336): Add minor fixes --------- Co-authored-by: David Jose Iglesias Lopez * refactor(#3333): Use utcnow() instead of now() * feat(#3337): AWS Config integration tests (#3705) * feat(#3337): Add basic test for aws config integration * feat(#3337): Add remove_from_bucket test for aws config integration * feat(#3337): Add only_logs_after tests for aws config integration * feat(#3337): Add path tests for aws config integration * feat(#3337): Add path_suffix tests for aws config integration * feat(#3337): Add regions tests for aws config integration * feat(#3337): Add discard_regex tests for aws config integration * feat(#3337): Add only_logs_after tier_1 tests for aws config integration * feat(#3337): Use non padaded month format * feat(#3337): Use join in path builds * feat(#3337): Improve message for check_non_processed_logs_from_output * fix(#3337): Add minor fixes * feat(#3338): ALB, CLB and NLB integration tests (#3711) * feat(#3338): Add basic test for aws ALB integration * feat(#3338): Add remove_from_bucket test for aws ALB integration * feat(#3338): Add schema for ALB table * feat(#3338): Add only_logs_after tests for aws ALB integration * feat(#3338): Add path tests for aws ALB integration * feat(#3338): Add regions tests for aws ALB integration * feat(#3338): Add regions discard_regex for aws ALB integration * feat(#3338): Add regions only_logs_after tier 1 for aws ALB integration * feat(#3338): Improve upload_and_delete_file_to_s3 fixture * feat(#3338): Skip remove_from_bucket test case for ALB * feat(#3338): Add basic test for aws CLB integration * feat(#3338): Add remove_from_bucket test for aws CLB integration * feat(#3338): Add only_logs_after tests for aws CLB integration * feat(#3338): Add path tests for aws CLB integration * feat(#3338): Add regions only_logs_after tier 1 for aws CLB integration * feat(#3338): Add regions discard_regex for aws CLB integration * feat(#3338): Add only_logs_after tier 1 for aws CLB integration * feat(#3338): Skip remove_from_bucket test case for CLB * feat(#3338): Add basic test for aws NLB integration * feat(#3338): Add remove_from_bucket test for aws NLB integration * feat(#3338): Add only_logs_after tests for aws NLB integration * feat(#3338): Add path tests for aws NLB integration * feat(#3338): Add regions tests for aws NLB integration * feat(#3338): Add only_logs_after tier 1 for aws NLB integration * style(#3335): Fix linter issues * feat(#3338): Move skip function to a fixture * feat(#3338): Use join in path builds * feat(#3338): Improve docstrings * feat(#3338): Increase timeout to avoid random failures * refactor(#3338): Use utcnow() instead of now() and typos * refactor(#3338): Apply changes from CR * feat(#3339): KMS integration tests (#3715) * feat(#3339): Add basic test for aws KMS integration * feat(#3339): Add data generator for KMS type * feat(#3339): Add remove_from_bucket test for aws KMS integration * feat(#3339): Add schema for custom table * feat(#3339): Add only_logs_after tests for aws KMS integration * feat(#3339): Add path tests for aws KMS integration * feat(#3339): Add discard_regex tests for aws KMS integration * feat(#3339): Adapt only_logs_after tier 1 test to custom types * feat(#3339): Add only_logs_after tier 1 for aws KMS integration * feat(#3339): Use join in path builds * feat(#3339): Improve skipped logs count in tier 1 test * feat(#3339): Add missing docstring * style(#3339): Apply suggestions from code review Co-authored-by: Facundo Dalmau * refactor(#3339): Use utcnow() instead of now() and typos * fix(#3339): Apply suggestions from code review Co-authored-by: David Jose Iglesias Lopez --------- Co-authored-by: Facundo Dalmau Co-authored-by: David Jose Iglesias Lopez * feat(#3340): Macie integration tests (#3734) * feat(#3340): Add basic test for aws Macie integration * feat(#3336): Add data generator for vpcflow type * feat(#3340): Add remove_from_bucket test for aws Macie integration * feat(#3340): Add only_logs_after tests for aws Macie integration * feat(#3340): Add path tests for aws Macie integration * feat(#3340): Add discard_regex tests for aws Macie integration * feat(#3340): Add only_logs_after tier 1 for aws Macie integration * feat(#3340): Use join in path builds * fix(#3340): Fix typo * fix(#3340): Remove unused arguments * style(#3340): Apply suggestions from code review Co-authored-by: David Jose Iglesias Lopez --------- Co-authored-by: David Jose Iglesias Lopez * fix(#3333): Improve test condition * feat(#3341): Trusted Advisor integration tests (#3736) * feat(#3341): Add basic test for aws Trusted Advisor integration * feat(#3339): Add data generator for KMS type * feat(#3341): Add remove_from_bucket test * feat(#3341): Add only_logs_after tests for aws Trusted Advisor integration * feat(#3341): Add path tests for aws Trusted Advisor integration * feat(#3341): Add discard_regex tests for aws Trusted Advisor integration * feat(#3341): Add only_logs_after tier 1 for aws Trusted Advisor integration * feat(#3342): GuardDuty integration tests (#3762) * feat(#3342): Add basic test for aws GuardDuty integration * feat(#3342): Add remove_from_bucket test for aws Guard Duty integration * feat(#3342): Add schema for GuardDuty table * feat(#3342): Add only_logs_after tests for aws GuardDuty integration * feat(#3342): Add path tests for aws GuardDuty integration * feat(#3342): Add discard_regex tests for aws GuardDuty integration * feat(#3342): Add only_logs_after tier 1 for aws GuarDuty integration * fix(#3342): Adjust the number of found logs * feat(#3342): Add missing docstring * feat(#3342): Add data generator for Native GD * feat(#3342): Add test cases for Native GuardDuty * refactor(#3342): Improve tier 1 test findings * fix(#3333): Improve some test findings * feat(#3343): WAF integration tests (#3763) * feat(#3343): Add basic test for aws WAF integration * feat(#3343): Add data generator for WAF type * feat(#3343): Add remove_from_bucket test for aws WAF integration * feat(#3343): Add schema for WAF table * feat(#3343): Add only_logs_after tests for aws WAF integration * feat(#3343): Add path tests for aws WAF integration * feat(#3343): Add discard_regex tests for aws WAF integration * feat(#3343): Add only_logs_after tier 1 for aws WAF integration * style(#3343): Apply suggestions from code review Co-authored-by: Facundo Dalmau * refactor(#3343): Improve discard_regex test findings --------- Co-authored-by: Facundo Dalmau * feat(#3344): Server Access integration tests (#3771) * feat(#3344): Add basic test for aws server access integration * feat(#3344): Add data generator for Server Access type * feat(#3344): Add remove_from_bucket test for aws SA integration * feat(#3344): Add schema for ServerAccess table * feat(#3344): Add only_logs_after tests for aws SA integration * feat(#3344): Add path tests for aws SA integration * feat(#3344): Add discard_regex tests for aws FA integration * feat(#3344): Add only_logs_after tier 1 for aws SA integration * feat(#3344): Use table_name instead of bucket_type * style(#3344): Apply suggestions from code review Co-authored-by: Facundo Dalmau --------- Co-authored-by: Facundo Dalmau * feat(#3345): Add basic test for aws inspector integration * feat(#3345): Add only_logs_after tests for aws Inspector integration * feat(#3345): Add only_logs_after tier 1 for Inspector integration * refactor(#3345): Minor fixes * style(#3345): Apply suggestions from code review Co-authored-by: Facundo Dalmau * style(#3345): Apply suggestions from code review Co-authored-by: José Luis López Sánchez * feat(#3346): CloudWatch integration tests (#3857) * feat(#3346): Add basic test for aws cloudwatch integration * feat(#3346): Rename basic test for buckets integration * feat(#3346): Add tools for cloudwatch integration * feat(#3346): Add remove_log_streams test for aws cloudwatch integration * feat(#3346): Add utils for cloudwatch tests * feat(#3346): Add fixtures for cloudwatch tests * feat(#3346): Add only_logs_after tests for aws CloudWatch integration * feat(#3346): Rename only_logs_after tests for buckets integration * feat(#3346): Add regions tests for aws CloudWatch integration * feat(#3346): Rename regions tests for buckets integration * feat(#3346): Add log_groups tests for aws CloudWatch integration * feat(#3346): Add only_logs_after tier 1 for aws CloudWatch integration * feat(#3346): Rename tier 1 tests for buckets integration * refactor(#3346): Minor fixes * style(#3346): Apply suggestions from code review Co-authored-by: Facundo Dalmau * style(#3346): Apply suggestions from code review Co-authored-by: Facundo Dalmau --------- Co-authored-by: Facundo Dalmau * feat(#3347): Umbrella integration tests (#3796) * feat(#3347): Add basic test for aws umbrella integration * feat(#3347): Add data generator for Umbrella type * feat(#3347): Add remove_from_bucket test for aws Umbrella integration * feat(#3347): Add schema for Umbrella table * feat(#3347): Add only_logs_after tests for aws Umbrella integration * feat(#3347): Add path tests for aws Umbrella integration * feat(#3347): Add discard_regex tests for aws Umbrella integration * feat(#3347): Add only_logs_after tier 1 for aws Umbrella integration * style(#3347): Apply suggestions from code review Co-authored-by: Facundo Dalmau * fix(#3347): Fix discard_regex test findings --------- Co-authored-by: Facundo Dalmau * fix(#3333): Add missing PATH with empty value * feat(#3581): Parser integration tests (#3882) * feat(#3581): Add tests for mandatory missing params * feat(#3581): Add tests for empty values * feat(#3581): Add tests for invalid values * feat(#3581): Add tests for multiple bucket and service tags * style(#3581): Apply suggestions from code review Co-authored-by: Facundo Dalmau * style(#3581): Apply suggestions from code review Co-authored-by: Facundo Dalmau --------- Co-authored-by: Facundo Dalmau * fix(#3333): Adjust some tests values * fix(#3333): Fix cloudwatchlogs_log_groups_with_data test * fix(#3333): Adjust cisco_umbrella_only_logs_after_multiple_calls values * fix(#3333): Normalize tier1 tests for all bucket integrations * feat(#3348): AWS integration tests readme (#3892) * docs(#3348): Add AWS integration tests README * docs(#3348): Add referece to AWS tests * refactor(#3348): Improve explanation about credentials Co-authored-by: Facundo Dalmau --------- Co-authored-by: Facundo Dalmau * fix(#3333): Adjust inexistent_region test for services * fix(#3333): Adjust parser tests * fix(#3333): Change message to search for services region tests * fix(#3333): Marked inspector tier 1 test as xfail * fix(#3333): Splitted inspector and cloudwatch logs * fix(#3333): Timeouts adjustments * fix(#3333): Fixed tests cases for cloudwatch tier 1 tests * fix(#3333): Fixed linter issues * docs(#3333): Added changelog * fix(#3333): Fixed order and format * fix(#3333): Moved constants to __init__.py * fix(#3333): Replaced wazuh_log_monitor with file_monitoring * fix(#3333): Moved constants to wazuh_testing/__init__.py * fix(#3333): Moved constants to test_aws/__init__.py * fix(#3333): Improved docstring * fix(#3333): Moved exception to new file * fix(#3333): Improved fixtures and removed unused ones * fix(#3333): Fixed quotation marks * fix(#3333): Removed type hints * fix(#3339): Apply suggestions from code review Co-authored-by: Julia Magán <80041853+juliamagan@users.noreply.github.com> * fix(#3333): Install boto3 only in linux * fix(#3339): Apply suggestions from code review Co-authored-by: Julia Magán <80041853+juliamagan@users.noreply.github.com> * fix(#3333): Moved constants --------- Co-authored-by: José Luis López Sánchez Co-authored-by: David Jose Iglesias Lopez Co-authored-by: Facundo Dalmau Co-authored-by: Julia Magán <80041853+juliamagan@users.noreply.github.com> --- CHANGELOG.md | 1 + deps/wazuh_testing/wazuh_testing/__init__.py | 2 + .../modules/api/event_monitor.py | 3 +- .../wazuh_testing/modules/aws/__init__.py | 58 + .../wazuh_testing/modules/aws/cli_utils.py | 61 + .../modules/aws/cloudwatch_utils.py | 87 ++ .../modules/aws/data_generator.py | 1183 +++++++++++++++++ .../wazuh_testing/modules/aws/db_utils.py | 256 ++++ .../modules/aws/event_monitor.py | 329 +++++ .../wazuh_testing/modules/aws/exceptions.py | 2 + .../wazuh_testing/modules/aws/s3_utils.py | 89 ++ .../wazuh_testing/tools/utils.py | 16 +- requirements.txt | 1 + tests/integration/README.md | 5 +- tests/integration/test_aws/README.md | 180 +++ tests/integration/test_aws/conftest.py | 161 +++ .../bucket_configuration_defaults.yaml | 15 + .../cloudwatch_configuration_defaults.yaml | 17 + .../inspector_configuration_defaults.yaml | 15 + .../configuration_discard_regex.yaml | 23 + .../configuration_log_groups.yaml | 19 + ...et_configuration_with_only_logs_after.yaml | 19 + ...configuration_without_only_logs_after.yaml | 17 + ...ch_configuration_with_only_logs_after.yaml | 19 + ...or_configuration_with_only_logs_after.yaml | 17 + ...configuration_without_only_logs_after.yaml | 17 + ...figuration_bucket_and_service_missing.yaml | 7 + ...tion_multiple_bucket_and_service_tags.yaml | 47 + .../configuration_type_missing_in_bucket.yaml | 13 + ...configuration_type_missing_in_service.yaml | 13 + .../configuration_values_in_bucket.yaml | 25 + .../configuration_values_in_service.yaml | 21 + .../configuration_path_suffix.yaml | 19 + .../path_test_module/configuration_path.yaml | 19 + .../bucket_configuration_regions.yaml | 19 + .../cloudwatch_configuration_regions.yaml | 19 + .../inspector_configuration_regions.yaml | 17 + .../configuration_remove_from_bucket.yaml | 19 + .../configuration_remove_log_stream.yaml | 19 + .../cases_bucket_defaults.yaml | 125 ++ .../cases_cloudwatch_defaults.yaml | 8 + .../cases_inspector_defaults.yaml | 6 + .../cases_discard_regex.yaml | 238 ++++ .../cases_log_groups.yaml | 21 + .../cases_bucket_multiple_calls.yaml | 98 ++ .../cases_bucket_with_only_logs_after.yaml | 183 +++ .../cases_bucket_without_only_logs_after.yaml | 155 +++ .../cases_cloudwatch_multiple_calls.yaml | 6 + ...cases_cloudwatch_with_only_logs_after.yaml | 12 + .../cases_inspector_multiple_calls.yaml | 5 + .../cases_inspector_with_only_logs_after.yaml | 9 + ...cases_service_without_only_logs_after.yaml | 9 + .../cases_bucket_and_service_missing.yaml | 4 + .../cases_empty_values_in_bucket.yaml | 71 + .../cases_empty_values_in_service.yaml | 39 + .../cases_invalid_values_in_bucket.yaml | 83 ++ .../cases_invalid_values_in_service.yaml | 49 + ...ases_multiple_bucket_and_service_tags.yaml | 4 + .../cases_type_missing_in_bucket.yaml | 4 + .../cases_type_missing_in_service.yaml | 4 + .../cases_path_suffix.yaml | 116 ++ .../path_test_module/cases_path.yaml | 548 ++++++++ .../cases_bucket_regions.yaml | 233 ++++ .../cases_cloudwatch_regions.yaml | 38 + .../cases_inspector_regions.yaml | 32 + .../cases_remove_from_bucket.yaml | 140 ++ .../cases_remove_log_streams.yaml | 8 + tests/integration/test_aws/test_basic.py | 315 +++++ .../test_aws/test_discard_regex.py | 142 ++ tests/integration/test_aws/test_log_groups.py | 157 +++ .../test_aws/test_only_logs_after.py | 918 +++++++++++++ tests/integration/test_aws/test_parser.py | 597 +++++++++ tests/integration/test_aws/test_path.py | 155 +++ .../integration/test_aws/test_path_suffix.py | 157 +++ tests/integration/test_aws/test_regions.py | 443 ++++++ .../test_aws/test_remove_from_bucket.py | 225 ++++ 76 files changed, 8220 insertions(+), 6 deletions(-) create mode 100644 deps/wazuh_testing/wazuh_testing/modules/aws/__init__.py create mode 100644 deps/wazuh_testing/wazuh_testing/modules/aws/cli_utils.py create mode 100644 deps/wazuh_testing/wazuh_testing/modules/aws/cloudwatch_utils.py create mode 100644 deps/wazuh_testing/wazuh_testing/modules/aws/data_generator.py create mode 100644 deps/wazuh_testing/wazuh_testing/modules/aws/db_utils.py create mode 100644 deps/wazuh_testing/wazuh_testing/modules/aws/event_monitor.py create mode 100644 deps/wazuh_testing/wazuh_testing/modules/aws/exceptions.py create mode 100644 deps/wazuh_testing/wazuh_testing/modules/aws/s3_utils.py create mode 100644 tests/integration/test_aws/README.md create mode 100644 tests/integration/test_aws/conftest.py create mode 100644 tests/integration/test_aws/data/configuration_template/basic_test_module/bucket_configuration_defaults.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/basic_test_module/cloudwatch_configuration_defaults.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/basic_test_module/inspector_configuration_defaults.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/discard_regex_test_module/configuration_discard_regex.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/log_groups_test_module/configuration_log_groups.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/bucket_configuration_with_only_logs_after.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/bucket_configuration_without_only_logs_after.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/cloudwatch_configuration_with_only_logs_after.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/inspector_configuration_with_only_logs_after.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/service_configuration_without_only_logs_after.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_bucket_and_service_missing.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_multiple_bucket_and_service_tags.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_type_missing_in_bucket.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_type_missing_in_service.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_values_in_bucket.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_values_in_service.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/path_suffix_test_module/configuration_path_suffix.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/path_test_module/configuration_path.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/regions_test_module/bucket_configuration_regions.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/regions_test_module/cloudwatch_configuration_regions.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/regions_test_module/inspector_configuration_regions.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/remove_from_bucket_test_module/configuration_remove_from_bucket.yaml create mode 100644 tests/integration/test_aws/data/configuration_template/remove_from_bucket_test_module/configuration_remove_log_stream.yaml create mode 100644 tests/integration/test_aws/data/test_cases/basic_test_module/cases_bucket_defaults.yaml create mode 100644 tests/integration/test_aws/data/test_cases/basic_test_module/cases_cloudwatch_defaults.yaml create mode 100644 tests/integration/test_aws/data/test_cases/basic_test_module/cases_inspector_defaults.yaml create mode 100644 tests/integration/test_aws/data/test_cases/discard_regex_test_module/cases_discard_regex.yaml create mode 100644 tests/integration/test_aws/data/test_cases/log_groups_test_module/cases_log_groups.yaml create mode 100644 tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_multiple_calls.yaml create mode 100644 tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_with_only_logs_after.yaml create mode 100644 tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_without_only_logs_after.yaml create mode 100644 tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_cloudwatch_multiple_calls.yaml create mode 100644 tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_cloudwatch_with_only_logs_after.yaml create mode 100644 tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_inspector_multiple_calls.yaml create mode 100644 tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_inspector_with_only_logs_after.yaml create mode 100644 tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_service_without_only_logs_after.yaml create mode 100644 tests/integration/test_aws/data/test_cases/parser_test_module/cases_bucket_and_service_missing.yaml create mode 100644 tests/integration/test_aws/data/test_cases/parser_test_module/cases_empty_values_in_bucket.yaml create mode 100644 tests/integration/test_aws/data/test_cases/parser_test_module/cases_empty_values_in_service.yaml create mode 100644 tests/integration/test_aws/data/test_cases/parser_test_module/cases_invalid_values_in_bucket.yaml create mode 100644 tests/integration/test_aws/data/test_cases/parser_test_module/cases_invalid_values_in_service.yaml create mode 100644 tests/integration/test_aws/data/test_cases/parser_test_module/cases_multiple_bucket_and_service_tags.yaml create mode 100644 tests/integration/test_aws/data/test_cases/parser_test_module/cases_type_missing_in_bucket.yaml create mode 100644 tests/integration/test_aws/data/test_cases/parser_test_module/cases_type_missing_in_service.yaml create mode 100644 tests/integration/test_aws/data/test_cases/path_suffix_test_module/cases_path_suffix.yaml create mode 100644 tests/integration/test_aws/data/test_cases/path_test_module/cases_path.yaml create mode 100644 tests/integration/test_aws/data/test_cases/regions_test_module/cases_bucket_regions.yaml create mode 100644 tests/integration/test_aws/data/test_cases/regions_test_module/cases_cloudwatch_regions.yaml create mode 100644 tests/integration/test_aws/data/test_cases/regions_test_module/cases_inspector_regions.yaml create mode 100644 tests/integration/test_aws/data/test_cases/remove_from_bucket_test_module/cases_remove_from_bucket.yaml create mode 100644 tests/integration/test_aws/data/test_cases/remove_from_bucket_test_module/cases_remove_log_streams.yaml create mode 100644 tests/integration/test_aws/test_basic.py create mode 100644 tests/integration/test_aws/test_discard_regex.py create mode 100644 tests/integration/test_aws/test_log_groups.py create mode 100644 tests/integration/test_aws/test_only_logs_after.py create mode 100644 tests/integration/test_aws/test_parser.py create mode 100644 tests/integration/test_aws/test_path.py create mode 100644 tests/integration/test_aws/test_path_suffix.py create mode 100644 tests/integration/test_aws/test_regions.py create mode 100644 tests/integration/test_aws/test_remove_from_bucket.py diff --git a/CHANGELOG.md b/CHANGELOG.md index dfd57373f6..6ed3507da8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ Release report: TBD ### Added +- Add integration tests for AWS module. ([#3911](https://github.com/wazuh/wazuh-qa/pull/3911)) \- (Framework + Tests + Documentation) - Add tests for msu patches with no associated CVE . ([#4009](https://github.com/wazuh/wazuh-qa/pull/4009)) \- (Framework + Tests) - Add tests with new options to avoid FIM synchronization overlapping. ([#3318](https://github.com/wazuh/wazuh-qa/pull/3318)) \- (Framework + tests) - Add Logcollector millisecond granularity support test case ([#3910](https://github.com/wazuh/wazuh-qa/pull/3910)) \- (Tests) diff --git a/deps/wazuh_testing/wazuh_testing/__init__.py b/deps/wazuh_testing/wazuh_testing/__init__.py index 24d541af85..2972b10f57 100644 --- a/deps/wazuh_testing/wazuh_testing/__init__.py +++ b/deps/wazuh_testing/wazuh_testing/__init__.py @@ -40,6 +40,8 @@ WAZUH_TESTING_PATH = os.path.dirname(os.path.abspath(__file__)) WAZUH_TESTING_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') DEFAULT_AUTHD_PASS_PATH = os.path.join(WAZUH_PATH, 'etc', 'authd.pass') +TEMPLATE_DIR = 'configuration_template' +TEST_CASES_DIR = 'test_cases' # Daemons diff --git a/deps/wazuh_testing/wazuh_testing/modules/api/event_monitor.py b/deps/wazuh_testing/wazuh_testing/modules/api/event_monitor.py index 1bbcc8f0f8..de599e7614 100644 --- a/deps/wazuh_testing/wazuh_testing/modules/api/event_monitor.py +++ b/deps/wazuh_testing/wazuh_testing/modules/api/event_monitor.py @@ -35,9 +35,10 @@ def check_api_event(file_monitor=None, callback='', error_message=None, update_p callback (str): log regex to check in the file error_message (str): error message to show in case of expected event does not occur update_position (boolean): filter configuration parameter to search in the file - timeout (str): timeout to check the event in the file + timeout (int): timeout to check the event in the file prefix (str): log pattern regex accum_results (int): Accumulation of matches. + file_to_monitor (str): File to be monitored. """ file_monitor = FileMonitor(file_to_monitor) if file_monitor is None else file_monitor error_message = f"Could not find this event in {file_to_monitor}: {callback}" if error_message is None else \ diff --git a/deps/wazuh_testing/wazuh_testing/modules/aws/__init__.py b/deps/wazuh_testing/wazuh_testing/modules/aws/__init__.py new file mode 100644 index 0000000000..04281b5b4e --- /dev/null +++ b/deps/wazuh_testing/wazuh_testing/modules/aws/__init__.py @@ -0,0 +1,58 @@ +from pathlib import Path + +from wazuh_testing import WAZUH_PATH + +AWS_MODULE_PATH = Path(WAZUH_PATH, 'wodles', 'aws') +S3_CLOUDTRAIL_DB_PATH = Path(AWS_MODULE_PATH, 's3_cloudtrail.db') +AWS_SERVICES_DB_PATH = Path(AWS_MODULE_PATH, 'aws_services.db') + +AWS_LOGS = 'AWSLogs' +RANDOM_ACCOUNT_ID = '819751203818' +CLOUDTRAIL = 'CloudTrail' +GUARDDUTY = 'GuardDuty' +VPC_FLOW_LOGS = 'vpcflowlogs' +FLOW_LOG_ID = 'fl-0754d951c16f517fa' +CONFIG = 'Config' +ELASTIC_LOAD_BALANCING = 'elasticloadbalancing' +SERVER_ACCESS_TABLE_NAME = 's3_server_access' +PERMANENT_CLOUDWATCH_LOG_GROUP = 'wazuh-cloudwatchlogs-integration-tests' +TEMPORARY_CLOUDWATCH_LOG_GROUP = 'temporary-log-group' +FAKE_CLOUDWATCH_LOG_GROUP = 'fake-log-group' + +EVENT_TIME_FORMAT = '%Y-%m-%dT%H:%M:%SZ' +PATH_DATE_FORMAT = '%Y/%m/%d' +PATH_DATE_NO_PADED_FORMAT = '%Y/%-m/%-d' +FILENAME_DATE_FORMAT = '%Y%m%dT%H%MZ' +ALB_DATE_FORMAT = '%Y-%m-%dT%H:%M:%fZ' + +US_EAST_1_REGION = 'us-east-1' + +JSON_EXT = '.json' +LOG_EXT = '.log' +JSON_GZ_EXT = '.jsonl.gz' +CSV_EXT = '.csv' + +# Bucket types +CLOUD_TRAIL_TYPE = 'cloudtrail' +VPC_FLOW_TYPE = 'vpcflow' +CONFIG_TYPE = 'config' +ALB_TYPE = 'alb' +CLB_TYPE = 'clb' +NLB_TYPE = 'nlb' +KMS_TYPE = 'kms' +MACIE_TYPE = 'macie' +KMS_TYPE = 'kms' +TRUSTED_ADVISOR_TYPE = 'trusted' +CUSTOM_TYPE = 'custom' +GUARD_DUTY_TYPE = 'guardduty' +NATIVE_GUARD_DUTY_TYPE = 'native-guardduty' +WAF_TYPE = 'waf' +SERVER_ACCESS = 'server_access' +CISCO_UMBRELLA_TYPE = 'cisco_umbrella' + +# Params + +ONLY_LOGS_AFTER_PARAM = '--only_logs_after' + + +local_internal_options = {'wazuh_modules.debug': '2', 'monitord.rotate_log': '0'} diff --git a/deps/wazuh_testing/wazuh_testing/modules/aws/cli_utils.py b/deps/wazuh_testing/wazuh_testing/modules/aws/cli_utils.py new file mode 100644 index 0000000000..b540a7a73b --- /dev/null +++ b/deps/wazuh_testing/wazuh_testing/modules/aws/cli_utils.py @@ -0,0 +1,61 @@ +import subprocess +from pathlib import Path + +from wazuh_testing import logger +from wazuh_testing.modules.aws import AWS_MODULE_PATH +from wazuh_testing.modules.aws.exceptions import OutputAnalysisError + +AWS_BINARY_PATH = Path(AWS_MODULE_PATH, 'aws-s3') + + +def call_aws_module(*parameters): + """Given some parameters call the AWS module and return the output. + + Returns: + str: The command output. + """ + command = [AWS_BINARY_PATH, *parameters] + logger.debug("Calling AWS module with: '%s'", command) + command_result = subprocess.run(command, capture_output=True) + + return command_result.stdout.decode() + + +def _default_callback(line: str): + print(line) + return line + + +def analyze_command_output( + command_output, callback=_default_callback, expected_results=1, error_message='' +): + """Analyze the given command output searching for a pattern. + + Args: + command_output (str): The output to analyze. + callback (Callable, optional): A callback to process each line. Defaults to _default_callback. + expected_results (int, optional): Number of expected results. Defaults to 1. + error_message (str, optional): Message to show with the exception. Defaults to ''. + + Raises: + OutputAnalysisError: When the expected results are not correct. + """ + + results = [] + + for line in command_output.splitlines(): + logger.debug(line) + item = callback(line) + + if item is not None: + results.append(item) + + results_len = len(results) + + if results_len != expected_results: + if error_message: + logger.error(error_message) + logger.error('Results found: %s', results_len) + logger.error('Results expected: %s', expected_results) + raise OutputAnalysisError(error_message) + raise OutputAnalysisError() diff --git a/deps/wazuh_testing/wazuh_testing/modules/aws/cloudwatch_utils.py b/deps/wazuh_testing/wazuh_testing/modules/aws/cloudwatch_utils.py new file mode 100644 index 0000000000..a4ea30ed92 --- /dev/null +++ b/deps/wazuh_testing/wazuh_testing/modules/aws/cloudwatch_utils.py @@ -0,0 +1,87 @@ +"""AWS CloudWatch related utils""" + +from time import time +from uuid import uuid4 + +import boto3 +from wazuh_testing.modules.aws import PERMANENT_CLOUDWATCH_LOG_GROUP, US_EAST_1_REGION + +session = boto3.Session(profile_name='qa') +logs = session.client('logs', region_name=US_EAST_1_REGION) + + +def create_log_group(log_group_name): + """Create a log group. + + Args: + log_group_name (str): Log group name to create. + """ + logs.create_log_group(logGroupName=log_group_name) + + +def delete_log_group(log_group_name): + """Delete the given log group. + + Args: + log_group_name (str): Log group name to delete. + """ + logs.delete_log_group(logGroupName=log_group_name) + + +def create_log_stream(log_group=PERMANENT_CLOUDWATCH_LOG_GROUP): + """Create a log stream within the given log group. + + Args: + log_group (str, optional): Log group to store the stream. Defaults to PERMANENT_CLOUDWATCH_LOG_GROUP. + + Returns: + str: The name of the created log stream. + """ + log_stream_name = str(uuid4()) + logs.create_log_stream(logGroupName=log_group, logStreamName=log_stream_name) + + return log_stream_name + + +def delete_log_stream(log_stream, log_group=PERMANENT_CLOUDWATCH_LOG_GROUP): + """Delete a log stream from the given log group. + + Args: + log_stream (str): The log stream to delete. + log_group (str, optional): Log group to delete the stream. Defaults to PERMANENT_CLOUDWATCH_LOG_GROUP. + """ + logs.delete_log_stream(logGroupName=log_group, logStreamName=log_stream) + + +def create_log_events(log_stream, log_group=PERMANENT_CLOUDWATCH_LOG_GROUP, event_number=1): + """Create a log event within the given log stream and group. + + Args: + log_stream (str): The log stream to delete. + log_group (str, optional): Log group to delete the stream. Defaults to PERMANENT_CLOUDWATCH_LOG_GROUP. + event_number (int, optional): Number of events to create. Defaults to 1. + """ + + events = [ + {'timestamp': int(time() * 1000), 'message': f"Test event number {i}"} for i in range(event_number) + ] + + logs.put_log_events( + logGroupName=log_group, logStreamName=log_stream, logEvents=events, + ) + + +def log_stream_exists(log_group, log_stream) -> bool: + """Check if a log stream exists in a group. + + Args: + log_group (str): Log group to search within. + log_stream (str): Log stream to search. + + Returns: + bool: True if exists else False + """ + response = logs.describe_log_streams(logGroupName=log_group) + log_streams = [item['logStreamName'] for item in response['logStreams']] + + return log_stream in log_streams diff --git a/deps/wazuh_testing/wazuh_testing/modules/aws/data_generator.py b/deps/wazuh_testing/wazuh_testing/modules/aws/data_generator.py new file mode 100644 index 0000000000..aad90f7c2e --- /dev/null +++ b/deps/wazuh_testing/wazuh_testing/modules/aws/data_generator.py @@ -0,0 +1,1183 @@ +"""Utils to generate sample data to AWS""" +import csv +import json +from datetime import datetime +from io import StringIO +from os.path import join +from uuid import uuid4 + +from wazuh_testing.modules import aws as cons +from wazuh_testing.tools.utils import get_random_ip, get_random_port, get_random_string + + +def get_random_interface_id(): + """Return a random interface ID that match with the AWS format.""" + return f"eni-{get_random_string(17)}" + + +class DataGenerator: + BASE_PATH = '' + BASE_FILE_NAME = '' + + compress = False + + def get_filename(self, *args, **kwargs): + """Return the filename according to the integration format. + + Returns: + str: Synthetic filename. + """ + raise NotImplementedError() + + def get_data_sample(self, *args, **kwargs): + """Return a sample of data according to the integration format. + + Returns: + dict: Synthetic data. + """ + raise NotImplementedError() + + +class CloudTrailDataGenerator(DataGenerator): + BASE_PATH = join(cons.AWS_LOGS, cons.RANDOM_ACCOUNT_ID, cons.CLOUDTRAIL, cons.US_EAST_1_REGION) + BASE_FILE_NAME = f"{cons.RANDOM_ACCOUNT_ID}_{cons.CLOUDTRAIL}_{cons.US_EAST_1_REGION}_" + + def get_filename(self): + """Return the filename in the cloudtrail format. + + Example: + /AWSLogs////CloudTrail//// + + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_FORMAT)) + name = f"{self.BASE_FILE_NAME}{now.strftime(cons.FILENAME_DATE_FORMAT)}_{abs(hash(now))}{cons.JSON_EXT}" + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the cloudtrail format. + + Returns: + str: Synthetic data. + """ + return json.dumps({ + 'Records': [ + { + 'eventVersion': '1.08', + 'userIdentity': { + 'type': 'AWSService', + 'invokedBy': 'ec2.amazonaws.com' + }, + 'eventTime': datetime.utcnow().strftime(cons.EVENT_TIME_FORMAT), + 'eventSource': 'sts.amazonaws.com', + 'eventName': 'AssumeRole', + 'awsRegion': cons.US_EAST_1_REGION, + 'sourceIPAddress': 'ec2.amazonaws.com', + 'userAgent': 'ec2.amazonaws.com', + 'requestParameters': { + 'roleArn': f"arn:aws:iam::{cons.RANDOM_ACCOUNT_ID}:role/demo-415-v2-InstanceRole-1FB0FMP2EXOKN", + 'roleSessionName': 'i-0e9ddef5daf05c7df' + }, + 'responseElements': { + 'credentials': { + 'accessKeyId': 'ASIASNL6BLJL7ZA3J6WP', + 'sessionToken': str(uuid4()), + 'expiration': 'Dec 23, 2021, 3:51:35 PM' + } + }, + 'requestID': str(uuid4()), + 'eventID': str(uuid4()), + 'readOnly': True, + 'resources': [ + { + 'accountId': cons.RANDOM_ACCOUNT_ID, + 'type': 'AWS::IAM::Role', + 'ARN': f"arn:aws:iam::{cons.RANDOM_ACCOUNT_ID}:role/demo-415-v2-InstanceRole-1FB0FMP2EXOKN" + } + ], + 'eventType': 'AwsApiCall', + 'managementEvent': True, + 'eventCategory': 'Management', + 'recipientAccountId': cons.RANDOM_ACCOUNT_ID, + 'sharedEventID': str(uuid4()) + } + ] + }) + + +class VPCDataGenerator(DataGenerator): + BASE_PATH = join(cons.AWS_LOGS, cons.RANDOM_ACCOUNT_ID, cons.VPC_FLOW_LOGS, cons.US_EAST_1_REGION) + BASE_FILE_NAME = f"{cons.RANDOM_ACCOUNT_ID}_{cons.VPC_FLOW_LOGS}_{cons.US_EAST_1_REGION}_" + + def get_filename(self): + """Return the filename in the VPC format. + + Example: + /AWSLogs////vpcflowlogs//// + + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_FORMAT)) + name = ( + f"{self.BASE_FILE_NAME}{cons.FLOW_LOG_ID}_{now.strftime(cons.FILENAME_DATE_FORMAT)}_{abs(hash(now))}" + f"{cons.LOG_EXT}" + ) + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the VPC format. + + Returns: + str: Synthetic data. + """ + data = [ + [ + 'version', 'account-id', 'interface-id', 'srcaddr', 'dstaddr', 'srcport', 'dstport', 'protocol', + 'packets', 'bytes', 'start', 'end', 'action', 'log-status' + ] + ] + + for _ in range(5): + data.append( + [ + '2', cons.RANDOM_ACCOUNT_ID, get_random_interface_id(), get_random_ip(), get_random_ip(), + get_random_port(), get_random_port(), '6', '39', '4698', '1622505433', '1622505730', 'ACCEPT', 'OK' + ] + ) + buffer = StringIO() + csv.writer(buffer, delimiter=' ').writerows(data) + + return buffer.getvalue() + + +class ConfigDataGenerator(DataGenerator): + BASE_PATH = join(cons.AWS_LOGS, cons.RANDOM_ACCOUNT_ID, cons.CONFIG, cons.US_EAST_1_REGION) + BASE_FILE_NAME = f"{cons.RANDOM_ACCOUNT_ID}_{cons.CONFIG}_{cons.US_EAST_1_REGION}_ConfigHistory_AWS_" + + def get_filename(self): + """Return the filename in the Config format. + + Example: + /AWSLogs////Config//// + + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_NO_PADED_FORMAT)) + name = f"{self.BASE_FILE_NAME}{now.strftime(cons.FILENAME_DATE_FORMAT)}_{abs(hash(now))}{cons.JSON_EXT}" + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the Config format. + + Returns: + str: Synthetic data. + """ + return json.dumps({ + 'fileVersion': '1.0', + 'configurationItems': [ + { + 'relatedEvents': [], + 'relationships': [ + { + 'resourceId': f"vol-{get_random_string(17)}", + 'resourceType': 'AWS::EC2::Volume', + 'name': 'Is associated with ' + } + ], + 'configuration': { + 'complianceType': 'NON_COMPLIANT', + 'targetResourceId': f"vol-{get_random_string(17)}", + 'targetResourceType': 'AWS::EC2::Volume', + 'configRuleList': [ + { + 'configRuleArn': ( + f"arn:aws:config:us-east-1:{cons.RANDOM_ACCOUNT_ID}:config-rule/" + 'config-rule-b1eqqf'), + 'configRuleId': 'config-rule-b1eqqf', + 'configRuleName': 'encrypted-volumes', + 'complianceType': 'NON_COMPLIANT' + } + ] + }, + 'supplementaryConfiguration': {}, + 'tags': {}, + 'configurationItemVersion': '1.3', + 'configurationItemCaptureTime': '2020-06-01T02:12:37.713Z', + 'configurationStateId': 1590977557713, + 'awsAccountId': cons.RANDOM_ACCOUNT_ID, + 'configurationItemStatus': 'ResourceDiscovered', + 'resourceType': 'AWS::Config::ResourceCompliance', + 'resourceId': f"AWS::EC2::Volume/vol-{get_random_string(17)}", + 'awsRegion': 'us-east-1', + 'configurationStateMd5Hash': '' + } + ] + }) + + +class ALBDataGenerator(DataGenerator): + BASE_PATH = join(cons.AWS_LOGS, cons.RANDOM_ACCOUNT_ID, cons.ELASTIC_LOAD_BALANCING, cons.US_EAST_1_REGION) + BASE_FILE_NAME = f"{cons.RANDOM_ACCOUNT_ID}_{cons.ELASTIC_LOAD_BALANCING}_{cons.US_EAST_1_REGION}_" + + def get_filename(self): + """Return the filename in the ALB format. + + Example: + /AWSLogs////elasticloadbalancing//// + + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_FORMAT)) + name = ( + f"{self.BASE_FILE_NAME}_app.ALB-qatests_{now.strftime(cons.FILENAME_DATE_FORMAT)}_{abs(hash(now))}_" + f"{get_random_ip()}_pczeay_{cons.LOG_EXT}" + ) + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the ALB format. + + Returns: + str: Synthetic data. + """ + now = datetime.utcnow() + data = [] + + for _ in range(5): + data.append( + [ + 'http', # type + now.strftime(cons.ALB_DATE_FORMAT), # time + 'app/ALB-qatests', # elb + f"{get_random_ip()}:{get_random_port()}", # client:port + f"{get_random_ip()}:{get_random_port()}", # target:port + 0.001, # request_processing_time + 0.001, # target_processing_time + 0.000, # response_processing_time + 403, # elb_status_code + 403, # target_status_code + 136, # received_bytes + 5173, # sent_bytes + f"GET http://{get_random_ip()}:80/ HTTP/1.1", # request + 'Mozilla/5.0 (compatible; Nimbostratus-Bot/v1.3.2; http://cloudsystemnetworks.com)', # user_agent + '-', # ssl_cipher + '-', # ssl_protocol + # target_group_arn + f"arn:aws:elasticloadbalancing:{cons.US_EAST_1_REGION}:{cons.RANDOM_ACCOUNT_ID}:targetgroup/EC2/", + f"Root=1-5fbc4c52-{get_random_string(24)}", # trace_id + '-', # domain_name + '-', # chosen_cert_arn + 0, # matched_rule_priority + now.strftime(cons.ALB_DATE_FORMAT), # request_creation_time + 'forward', # actions_executed + '-', # redirect_url + '-', # error_reason + f"{get_random_ip()}:{get_random_port()} {get_random_ip()}:{get_random_port()}", # target:port_list + '403', # target_status_code_list + '-', # classification + '-' # classification_reason + ] + ) + buffer = StringIO() + csv.writer(buffer, delimiter=' ').writerows(data) + + return buffer.getvalue() + + +class CLBDataGenerator(DataGenerator): + BASE_PATH = join(cons.AWS_LOGS, cons.RANDOM_ACCOUNT_ID, cons.ELASTIC_LOAD_BALANCING, cons.US_EAST_1_REGION) + BASE_FILE_NAME = f"{cons.RANDOM_ACCOUNT_ID}_{cons.ELASTIC_LOAD_BALANCING}_{cons.US_EAST_1_REGION}_" + + def get_filename(self): + """Return the filename in the CLB format. + + Example: + /AWSLogs////elasticloadbalancing//// + + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_FORMAT)) + name = ( + f"{self.BASE_FILE_NAME}qatests-APIClassi_{now.strftime(cons.FILENAME_DATE_FORMAT)}_{abs(hash(now))}_" + f"{get_random_ip()}{cons.LOG_EXT}" + ) + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the CLB format. + + Returns: + str: Synthetic data. + """ + now = datetime.utcnow() + data = [] + for _ in range(5): + data.append( + [ + now.strftime(cons.ALB_DATE_FORMAT), # time + 'qatests-APIClassi', # elb + f"{get_random_ip()}:{get_random_port()}", # client:port + f"{get_random_ip()}:{get_random_port()}", # backend:port + 0.000628, # request_processing_time + 0.001, # backend_processing_time + 0.000015, # response_processing_time + 403, # elb_status_code + 403, # backend_status_code + 1071, # received_bytes + 2250, # sent_bytes + '- - -', # request + 'Mozilla/5.0 (compatible; Nimbostratus-Bot/v1.3.2; http://cloudsystemnetworks.com)', # user_agent + '-', # ssl_cipher + '-', # ssl_protocol + ] + ) + buffer = StringIO() + csv.writer(buffer, delimiter=' ').writerows(data) + + return buffer.getvalue() + + +class NLBDataGenerator(DataGenerator): + BASE_PATH = join(cons.AWS_LOGS, cons.RANDOM_ACCOUNT_ID, cons.ELASTIC_LOAD_BALANCING, cons.US_EAST_1_REGION) + BASE_FILE_NAME = f"{cons.RANDOM_ACCOUNT_ID}_{cons.ELASTIC_LOAD_BALANCING}_{cons.US_EAST_1_REGION}_" + + def get_filename(self): + """Return the filename in the NLB format. + + Example: + /AWSLogs////elasticloadbalancing//// + + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_FORMAT)) + name = ( + f"{self.BASE_FILE_NAME}net.qatests_{now.strftime(cons.FILENAME_DATE_FORMAT)}_{abs(hash(now))}_" + f"{get_random_ip()}{cons.LOG_EXT}" + ) + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the NLB format. + + Returns: + str: Synthetic data. + """ + now = datetime.utcnow() + data = [] + for _ in range(5): + data.append( + [ + 'tls', # type + '2.0', # version + now.strftime(cons.ALB_DATE_FORMAT), # time + 'net/qatests', # elb + get_random_string(16), # listener + f"{get_random_ip()}:{get_random_port()}", # client:port + f"{get_random_ip()}:{get_random_port()}", # destination:port + 17553, # connection_time + 0.001, # tls_handshake_time + 1071, # received_bytes + 2250, # sent_bytes + '-', # incoming_tls_alert + '-', # chosen_cert_arn + '-', # chosen_cert_serial + '-', # tls_cipher + '-', # tls_protocol_version + '-', # tls_named_group + '-', # domain_name + '-', # alpn_fe_protocol + '-', # alpn_be_protocol + '-', # alpn_client_preference_list + ] + ) + buffer = StringIO() + csv.writer(buffer, delimiter=' ').writerows(data) + + return buffer.getvalue() + + +class KMSDataGenerator(DataGenerator): + BASE_PATH = '' + BASE_FILE_NAME = 'firehose_kms-1-' + + def get_filename(self): + """Return the filename in the KMS format. + + Example: + /// + + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_FORMAT)) + name = f"{self.BASE_FILE_NAME}{now.strftime(cons.FILENAME_DATE_FORMAT)}_{str(uuid4())}{cons.JSON_EXT}" + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the KMS format. + + Returns: + str: Synthetic data. + """ + return json.dumps( + { + 'version': '0', + 'id': str(uuid4()), + 'detail-type': 'AWS API Call via CloudTrail', + 'source': 'aws.kms', + 'account': cons.RANDOM_ACCOUNT_ID, + 'time': '2018-11-07T17:27:01Z', + 'region': cons.US_EAST_1_REGION, + 'resources': [], + 'detail': { + 'eventVersion': '1.05', + 'userIdentity': { + 'type': 'IAMUser', + 'principalId': get_random_string(20), + 'arn': f"arn:aws:iam::{cons.RANDOM_ACCOUNT_ID}:user/fake.user", + 'accountId': cons.RANDOM_ACCOUNT_ID, + 'accessKeyId': get_random_string(20), + 'userName': 'fake.user', + 'sessionContext': { + 'attributes': { + 'mfaAuthenticated': 'false', + 'creationDate': '2018-11-07T07:53:47Z' + } + }, + 'invokedBy': 'secretsmanager.amazonaws.com' + }, + 'eventTime': '2018-11-07T17:27:01Z', + 'eventSource': 'kms.amazonaws.com', + 'eventName': 'GenerateDataKey', + 'awsRegion': cons.RANDOM_ACCOUNT_ID, + 'sourceIPAddress': 'secretsmanager.amazonaws.com', + 'userAgent': 'secretsmanager.amazonaws.com', + 'requestParameters': { + 'keySpec': 'AES_256', + 'encryptionContext': { + 'SecretARN': f"arn:aws:secretsmanager:us-east-1:{cons.RANDOM_ACCOUNT_ID}:secret:test-aws", + 'SecretVersionId': str(uuid4()) + }, + 'keyId': 'alias/aws/secretsmanager' + }, + 'responseElements': None, + 'requestID': str(uuid4()), + 'eventID': str(uuid4()), + 'readOnly': True, + 'resources': [ + { + 'ARN': f"arn:aws:kms:us-east-1:{cons.RANDOM_ACCOUNT_ID}:key/{str(uuid4())}", + 'accountId': cons.RANDOM_ACCOUNT_ID, + 'type': 'AWS::KMS::Key' + } + ], + 'eventType': 'AwsApiCall', + 'vpcEndpointId': f"vpce-{get_random_string(17)}" + } + } + ) + + +class MacieDataGenerator(DataGenerator): + BASE_PATH = '' + BASE_FILE_NAME = 'firehose_macie-1-' + + def get_filename(self): + """Return the filename in the Macie format. + + Example: + /// + + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_FORMAT)) + name = f"{self.BASE_FILE_NAME}{now.strftime(cons.FILENAME_DATE_FORMAT)}_{str(uuid4())}{cons.JSON_EXT}" + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the Macie format. + + Returns: + str: Synthetic data. + """ + + return json.dumps( + { + 'version': '0', + 'id': str(uuid4()), + 'detail-type': 'Macie Alert', + 'source': 'aws.macie', + 'account': cons.RANDOM_ACCOUNT_ID, + 'time': '2021-01-01T00:20:42Z', + 'region': 'us-east-1', + 'resources': [ + f"arn:aws:macie:us-east-1:{cons.RANDOM_ACCOUNT_ID}:trigger/{str(uuid4())}/alert", + f"arn:aws:macie:us-east-1:{cons.RANDOM_ACCOUNT_ID}:trigger/{str(uuid4())}" + ], + 'detail': { + 'notification-type': 'ALERT_CREATED', + 'tags': [ + 'Open Permissions', + 'Basic Alert' + ], + 'name': 'S3 Bucket IAM policy grants global read rights', + 'severity': 'CRITICAL', + 'url': 'https://mt.us-east-1.macie.aws.amazon.com/posts/arn%3Aaws%3Amacie%3Aus-east-1', + 'alert-arn': f"arn:aws:macie:us-east-1:{cons.RANDOM_ACCOUNT_ID}:trigger/{str(uuid4())}/alert", + 'risk-score': 9, + 'created-at': '2021-01-01T00:20:42.364509', + 'actor': 'resources.wazuh.com', + 'summary': { + 'Description': 'S3 Bucket uses IAM policy to grant read rights to Everyone.', + 'Bucket': { + 'resources.wazuh.com': 1 + }, + 'Record Count': 1, + 'ACL': { + 'resources.wazuh.com': [ + { + 'Owner': { + 'DisplayName': 'wazuh', + 'ID': get_random_string(64), + }, + 'Grants': [ + { + 'Grantee': { + 'Type': 'CanonicalUser', + 'DisplayName': 'wazuh', + 'ID': get_random_string(64), + }, + 'Permission': 'FULL_CONTROL' + }, + { + 'Grantee': { + 'Type': 'Group', + 'URI': 'http://acs.amazonaws.com/groups/global/AllUsers' + }, + 'Permission': 'READ' + } + ] + } + ] + }, + 'Event Count': 1, + 'Timestamps': { + '2021-01-01T00:11:49.171020Z': 1 + }, + 'recipientAccountId': { + cons.RANDOM_ACCOUNT_ID: 1 + } + }, + 'trigger': { + 'rule-arn': ( + f"arn:aws:macie:us-east-1:{cons.RANDOM_ACCOUNT_ID}:trigger/b731d9ffb1fe61508d4a478c92efa666" + ), + 'alert-type': 'basic', + 'created-at': '2020-12-29 16:36:17.412000+00:00', + 'description': 'S3 Bucket uses IAM policy to grant read rights to Everyone.', + 'risk': 9 + } + } + } + ) + + +class TrustedAdvisorDataGenerator(DataGenerator): + BASE_PATH = '' + BASE_FILE_NAME = 'firehose_trustedadvisor-1-' + + def get_filename(self): + """Return the filename in the Trusted Advisor format. + + Example: + /// + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_FORMAT)) + name = f"{self.BASE_FILE_NAME}{now.strftime(cons.FILENAME_DATE_FORMAT)}{cons.JSON_EXT}" + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the Trusted Advisor format. + + Returns: + str: Synthetic data. + """ + return json.dumps( + { + 'version': '0', + 'id': get_random_string(26), + 'detail-type': 'Trusted Advisor Check Item Refresh Notification', + 'source': 'aws.trustedadvisor', + 'account': cons.RANDOM_ACCOUNT_ID, + 'time': datetime.utcnow().strftime(cons.FILENAME_DATE_FORMAT), + 'region': 'us-east-1', + 'resources': [], + 'detail': { + 'check-name': 'IAM Group', + 'check-item-detail': { + 'Status': 'Green', + 'Current Usage': '1', + 'Limit Name': 'Groups', + 'Region': '-', + 'Service': 'IAM', + 'Limit Amount': '300' + }, + 'status': 'OK', + 'resource_id': '', + 'uuid': str(uuid4()) + } + } + ) + + +class GuardDutyDataGenerator(DataGenerator): + BASE_PATH = '' + BASE_FILE_NAME = 'firehose_guardduty-1-' + + def get_filename(self): + """Return the filename in the Guard Duty format. + + Example: + /// + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_FORMAT)) + name = f"{self.BASE_FILE_NAME}{now.strftime(cons.FILENAME_DATE_FORMAT)}{cons.JSON_EXT}" + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the Guard Duty format. + + Returns: + str: Synthetic data. + """ + return json.dumps( + { + 'version': '0', + 'id': str(uuid4()), + 'detail-type': 'GuardDuty Finding', + 'source': 'aws.guardduty', + 'account': cons.RANDOM_ACCOUNT_ID, + 'time': '2021-07-08T03:45:04Z', + 'region': 'us-east-1', + 'resources': [], + 'detail': { + 'schemaVersion': '2.0', + 'accountId': cons.RANDOM_ACCOUNT_ID, + 'region': 'us-east-1', + 'partition': 'aws', + 'id': 'e8bc77e2d65ffa20de95cc6e7a94e926', + 'arn': f"arn:aws:guardduty:us-east-1:{cons.RANDOM_ACCOUNT_ID}:detector/", + 'type': 'Recon:EC2/PortProbeUnprotectedPort', + 'resource': { + 'resourceType': 'Instance', + 'instanceDetails': { + 'instanceId': f"i-{get_random_string(8)}", + 'instanceType': 't2.micro', + 'launchTime': '2014-12-30T18:46:13Z', + 'platform': None, + 'productCodes': [], + 'iamInstanceProfile': None, + 'networkInterfaces': [ + { + 'ipv6Addresses': [], + 'networkInterfaceId': f"eni-{get_random_string(8)}", + 'privateDnsName': 'ip-10-0-0-250.ec2.internal', + 'privateIpAddress': get_random_ip(), + 'privateIpAddresses': [ + { + 'privateDnsName': 'ip-10-0-0-250.ec2.internal', + 'privateIpAddress': get_random_ip() + } + ], + 'subnetId': 'subnet-6b1d6203', + 'vpcId': f"vpc-{get_random_string(8)}", + 'securityGroups': [ + { + 'groupName': 'default', + 'groupId': f"sg-{get_random_string(8)}" + } + ], + 'publicDnsName': 'ec2-105-71-92-143.compute-1.amazonaws.com', + 'publicIp': get_random_ip() + } + ], + 'outpostArn': None, + 'tags': [ + { + 'key': 'service_name', + 'value': 'vpn' + }, + { + 'key': 'Name', + 'value': 'vpn-gateway (r)' + } + ], + 'instanceState': 'running', + 'availabilityZone': 'us-east-1e', + 'imageId': f"ami-{get_random_string(8)}", + 'imageDescription': 'None' + } + }, + 'service': { + 'serviceName': 'guardduty', + 'detectorId': str(uuid4()), + 'action': { + 'actionType': 'PORT_PROBE', + 'portProbeAction': { + 'portProbeDetails': [ + { + 'localPortDetails': { + 'port': 1723, + 'portName': 'Unknown' + }, + 'remoteIpDetails': { + 'ipAddressV4': get_random_ip(), + 'organization': { + 'asn': '211680', + 'asnOrg': 'Sistemas Informaticos, S.A.', + 'isp': 'Sistemas Informaticos, S.A.', + 'org': 'Sistemas Informaticos, S.A.' + }, + 'country': { + 'countryName': 'Portugal' + }, + 'city': { + 'cityName': '' + }, + 'geoLocation': { + 'lat': 38.7057, + 'lon': -9.1359 + } + } + } + ], + 'blocked': False + } + }, + 'resourceRole': 'TARGET', + 'additionalInfo': { + 'threatName': 'Scanner', + 'threatListName': 'ProofPoint' + }, + 'evidence': { + 'threatIntelligenceDetails': [ + { + 'threatNames': [ + 'Scanner' + ], + 'threatListName': 'ProofPoint' + } + ] + }, + 'eventFirstSeen': '2021-04-20T14:40:04Z', + 'eventLastSeen': '2021-07-08T03:15:41Z', + 'archived': False, + 'count': 5 + }, + 'severity': 2, + 'createdAt': '2021-04-20T14:53:32.735Z', + 'updatedAt': '2021-07-08T03:31:04.017Z', + 'title': 'Unprotected port on EC2 instance i-3bf6a5c5 is being probed.', + 'description': ( + 'EC2 instance has an unprotected port which is being probed by a known malicious host.' + ) + } + } + ) + + +class NativeGuardDutyDataGenerator(DataGenerator): + BASE_PATH = join(cons.AWS_LOGS, cons.RANDOM_ACCOUNT_ID, cons.GUARDDUTY, cons.US_EAST_1_REGION) + BASE_FILE_NAME = '' + + compress = True + + def get_filename(self): + """Return the filename in the Native Guard Duty format. + + Example: + /AWSLogs///GuardDuty//// + + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_FORMAT)) + name = f"{str(uuid4())}{cons.JSON_GZ_EXT}" + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the Native Guard Duty format. + + Returns: + str: Synthetic data. + """ + random_ip = get_random_ip() + return json.dumps( + { + 'schemaVersion': '2.0', + 'accountId': cons.RANDOM_ACCOUNT_ID, + 'region': 'us-east-1', + 'partition': 'aws', + 'id': '3ac1fd234445e957d526a10c72631c8f', + 'arn': f"arn:aws:guardduty:us-east-1:{cons.RANDOM_ACCOUNT_ID}:detector/c0bfff53bb19fbee16ed05a0b21d3b/", + 'type': 'UnauthorizedAccess:EC2/SSHBruteForce', + 'resource': { + 'resourceType': 'Instance', + 'instanceDetails': { + 'instanceId': f"i-{get_random_string(18)}", + 'instanceType': 'c5.large', + 'launchTime': '2022-10-19T16:17:42.000Z', + 'platform': None, + 'productCodes': [], + 'iamInstanceProfile': None, + 'networkInterfaces': [ + { + 'ipv6Addresses': [], + 'networkInterfaceId': f"eni-{get_random_string(18)}", + 'privateDnsName': f"ip-{random_ip.replace('.', '-')}.ec2.internal", + 'privateIpAddress': random_ip, + 'privateIpAddresses': [ + { + 'privateDnsName': f"ip-{random_ip.replace('.', '-')}.ec2.internal", + 'privateIpAddress': random_ip + } + ], + 'subnetId': f"subnet-{get_random_string(8)}", + 'vpcId': 'vpc-f825c385', + 'securityGroups': [ + { + 'groupName': 'test-ansible', + 'groupId': f"sg-{get_random_string(16)}" + } + ], + 'publicDnsName': f"ec2-{random_ip.replace('.', '-')}.compute-1.amazonaws.com", + 'publicIp': random_ip + } + ], + 'outpostArn': None, + 'tags': [ + { + 'key': 'Name', + 'value': 'some-test-server-investigating' + } + ], + 'instanceState': 'running', + 'availabilityZone': 'us-east-1d', + 'imageId': 'ami-026b57f3c383c2eec', + 'imageDescription': 'Amazon Linux 2 Kernel 5.10 AMI 2.0.20220912.1 x86_64 HVM gp2' + } + }, + 'service': { + 'serviceName': 'guardduty', + 'detectorId': 'c0bfff53bb19fbee16ed05a0b21d3be3', + 'action': { + 'actionType': 'NETWORK_CONNECTION', + 'networkConnectionAction': { + 'connectionDirection': 'INBOUND', + 'remoteIpDetails': { + 'ipAddressV4': random_ip, + 'organization': { + 'asn': '3462', + 'asnOrg': 'Data Communication Business Group', + 'isp': 'Chunghwa Telecom', + 'org': 'Chunghwa Telecom' + }, + 'country': { + 'countryName': 'Taiwan' + }, + 'city': { + 'cityName': 'Tainan City' + }, + 'geoLocation': { + 'lat': 22.9917, + 'lon': 120.2148 + } + }, + 'remotePortDetails': { + 'port': get_random_port(), + 'portName': 'Unknown' + }, + 'localPortDetails': { + 'port': 22, + 'portName': 'SSH' + }, + 'protocol': 'TCP', + 'blocked': False, + 'localIpDetails': { + 'ipAddressV4': random_ip + } + } + }, + 'resourceRole': 'TARGET', + 'additionalInfo': { + 'value': '{}', + 'type': 'default' + }, + 'eventFirstSeen': '2022-10-21T11:14:59.000Z', + 'eventLastSeen': '2022-10-21T11:19:24.000Z', + 'archived': False, + 'count': 1 + }, + 'severity': 2, + 'createdAt': '2022-10-21T11:21:10.027Z', + 'updatedAt': '2022-10-21T11:21:10.027Z', + 'title': f"{get_random_ip()} is performing SSH brute force attacks against i-08cb1e1f2bcce.", + 'description': f"{get_random_ip()} is performing SSH brute force attacks against i-08cb1ef2bcce.f" + } + ) + '\n' + + +class WAFDataGenerator(DataGenerator): + BASE_PATH = '' + BASE_FILE_NAME = 'aws-waf-logs-delivery-stream-1-' + + def get_filename(self): + """Return the filename in the KMS format. + + Example: + /// + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime(cons.PATH_DATE_FORMAT)) + name = f"{self.BASE_FILE_NAME}{now.strftime(cons.FILENAME_DATE_FORMAT)}{cons.JSON_EXT}" + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the cloudtrail format. + + Returns: + str: Synthetic data. + """ + return json.dumps( + { + 'timestamp': 1576280412771, + 'formatVersion': 1, + 'webaclId': ( + f"arn:aws:wafv2:ap-southeast-2:{cons.RANDOM_ACCOUNT_ID}:regional/" + 'webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE' + ), + 'terminatingRuleId': 'STMTest_SQLi_XSS', + 'terminatingRuleType': 'REGULAR', + 'action': 'BLOCK', + 'terminatingRuleMatchDetails': [ + { + 'conditionType': 'SQL_INJECTION', + 'sensitivityLevel': 'HIGH', + 'location': 'HEADER', + 'matchedData': [ + '10', + 'AND', + '1' + ] + } + ], + 'httpSourceName': '-', + 'httpSourceId': '-', + 'ruleGroupList': [], + 'rateBasedRuleList': [], + 'nonTerminatingMatchingRules': [], + 'httpRequest': { + 'clientIp': get_random_ip(), + 'country': 'AU', + 'headers': [ + { + 'name': 'Host', + 'value': 'localhost:1989' + }, + { + 'name': 'User-Agent', + 'value': 'curl/7.61.1' + }, + { + 'name': 'Accept', + 'value': '*/*' + }, + { + 'name': 'x-stm-test', + 'value': '10 AND 1=1' + } + ], + 'uri': '/myUri', + 'args': '', + 'httpVersion': 'HTTP/1.1', + 'httpMethod': 'GET', + 'requestId': 'rid' + }, + 'labels': [ + { + 'name': 'value' + } + ] + } + ) + + +class ServerAccessDataGenerator(DataGenerator): + BASE_PATH = '' + BASE_FILE_NAME = '' + + def get_filename(self): + """Return the filename in the server access format. + + Example: + / + + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + date_format = '%Y-%m-%d-%H-%M-%S' + name = f"{now.strftime(date_format)}-{get_random_string(16).upper()}" + return join(self.BASE_PATH, name) + + def get_data_sample(self): + """Return a sample of data according to the server access format. + + Returns: + str: Synthetic data. + """ + data = [] + + for _ in range(5): + data.append( + [ + str(uuid4()), 'wazuh-server-access-integration-tests', + datetime.utcnow().strftime('[%d/%b/%Y:%H:%M:%S %z]'), get_random_ip(), + f"arn:aws:iam::{cons.RANDOM_ACCOUNT_ID}:user/fake.user", get_random_string(16).upper(), + 'REST.GET.WEBSITE', '-', 'GET, /wazuh-server-access-integration-tests?website= HTTP/1.1', + '404', 'NoSuchWebsiteConfiguration', '343', '-', '85', '-', '-', + ( + 'S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.991' + 'Linux/4.9.230-0.1.ac.224.84.332.metal1.x86_64' + 'OpenJDK_64-Bit_Server_VM/25.282-b08 java/1.8.0_282 vendor/Oracle_Corporation' + 'cfg/retry-mode/legacy' + ), + '-', str(uuid4()), 'SigV4', 'ECDHE-RSA-AES128-GCM-SHA256', 'AuthHeader', 's3.amazonaws.com', + 'TLSv1.2' + + ] + ) + buffer = StringIO() + csv.writer(buffer, delimiter=' ').writerows(data) + + return buffer.getvalue() + + +class UmbrellaDataGenerator(DataGenerator): + BASE_PATH = 'dnslogs' + BASE_FILE_NAME = '' + + def get_filename(self): + """Return the filename in the umbrella format. + + Example: + /-- + Returns: + str: Synthetic filename. + """ + now = datetime.utcnow() + path = join(self.BASE_PATH, now.strftime('%Y-%m-%d')) + name = f"{self.BASE_FILE_NAME}{now.strftime('%Y-%m-%d')}-00-00-ioxa{cons.CSV_EXT}" + + return join(path, name) + + def get_data_sample(self): + """Return a sample of data according to the cloudtrail format. + + Returns: + str: Synthetic data. + """ + data = [] + + for _ in range(5): + data.append( + [ + datetime.utcnow().strftime('%Y-%m-%d %H:%M:%S'), + 'ActiveDirectoryUserName', + 'ActiveDirectoryUserName,ADSite,Network', + get_random_ip(), + get_random_ip(), + 'Allowed', + '1 (A)', + 'NOERROR', + 'domain-visited.com.', + 'Chat,Photo Sharing,Social Networking,Allow List' + ] + ) + buffer = StringIO() + csv.writer(buffer).writerows(data) + + return buffer.getvalue() + + +# Maps bucket type with corresponding data generator +buckets_data_mapping = { + cons.CLOUD_TRAIL_TYPE: CloudTrailDataGenerator, + cons.VPC_FLOW_TYPE: VPCDataGenerator, + cons.CONFIG_TYPE: ConfigDataGenerator, + cons.ALB_TYPE: ALBDataGenerator, + cons.CLB_TYPE: CLBDataGenerator, + cons.NLB_TYPE: NLBDataGenerator, + cons.KMS_TYPE: KMSDataGenerator, + cons.MACIE_TYPE: MacieDataGenerator, + cons.TRUSTED_ADVISOR_TYPE: TrustedAdvisorDataGenerator, + cons.GUARD_DUTY_TYPE: GuardDutyDataGenerator, + cons.NATIVE_GUARD_DUTY_TYPE: NativeGuardDutyDataGenerator, + cons.WAF_TYPE: WAFDataGenerator, + cons.SERVER_ACCESS: ServerAccessDataGenerator, + cons.CISCO_UMBRELLA_TYPE: UmbrellaDataGenerator +} + + +def get_data_generator(bucket_type, bucket_name): + """Given the bucket type return the correspondant data generator instance. + + Args: + bucket_type (str): Bucket type to match the data generator. + bucket_name (str): Bucket name to match in case of custom or guardduty types. + + Returns: + DataGenerator: Data generator for the given bucket. + """ + if bucket_type == cons.CUSTOM_TYPE: + bucket_type = bucket_name.split('-')[1] + elif bucket_type == cons.GUARD_DUTY_TYPE and 'native' in bucket_name: + bucket_type = cons.NATIVE_GUARD_DUTY_TYPE + + return buckets_data_mapping[bucket_type]() diff --git a/deps/wazuh_testing/wazuh_testing/modules/aws/db_utils.py b/deps/wazuh_testing/wazuh_testing/modules/aws/db_utils.py new file mode 100644 index 0000000000..274340ca46 --- /dev/null +++ b/deps/wazuh_testing/wazuh_testing/modules/aws/db_utils.py @@ -0,0 +1,256 @@ +import sqlite3 +from collections import namedtuple + +from wazuh_testing.modules.aws import ( + ALB_TYPE, + AWS_SERVICES_DB_PATH, + CISCO_UMBRELLA_TYPE, + CLB_TYPE, + CLOUD_TRAIL_TYPE, + CUSTOM_TYPE, + GUARD_DUTY_TYPE, + NLB_TYPE, + S3_CLOUDTRAIL_DB_PATH, + SERVER_ACCESS_TABLE_NAME, + VPC_FLOW_TYPE, + WAF_TYPE, +) + +SELECT_QUERY_TEMPLATE = 'SELECT * FROM {table_name}' + +S3CloudTrailRow = namedtuple( + 'S3CloudTrailRow', 'bucket_path aws_account_id aws_region log_key processed_date created_date' +) + +S3VPCFlowRow = namedtuple( + 'S3VPCFlowRow', 'bucket_path aws_account_id aws_region flowlog_id log_key processed_date created_date' +) + +S3ALBRow = namedtuple( + 'S3ALBRow', 'bucket_path aws_account_id log_key processed_date created_date' +) + +S3CustomRow = namedtuple( + 'S3CustomRow', 'bucket_path aws_account_id log_key processed_date created_date' +) + +S3GuardDutyRow = namedtuple( + 'S3GuardDutyRow', 'bucket_path aws_account_id log_key processed_date created_date' +) + +S3WAFRow = namedtuple( + 'S3WAFRow', 'bucket_path aws_account_id log_key processed_date created_date' +) + +S3ServerAccessRow = namedtuple( + 'S3ServerAccessRow', 'bucket_path aws_account_id log_key processed_date created_date' +) + +ServiceInspectorRow = namedtuple( + 'ServiceInspectorRow', 'service account_id region timestamp' +) + +ServiceCloudWatchRow = namedtuple( + 'ServiceCloudWatchRow', 'aws_region aws_log_group aws_log_stream next_token start_time end_time' +) + +S3UmbrellaRow = namedtuple( + 'S3UmbrellaRow', 'bucket_path aws_account_id log_key processed_date created_date' +) + +s3_rows_map = { + CLOUD_TRAIL_TYPE: S3CloudTrailRow, + VPC_FLOW_TYPE: S3VPCFlowRow, + ALB_TYPE: S3ALBRow, + CLB_TYPE: S3ALBRow, + NLB_TYPE: S3ALBRow, + CUSTOM_TYPE: S3CustomRow, + GUARD_DUTY_TYPE: S3GuardDutyRow, + WAF_TYPE: S3WAFRow, + SERVER_ACCESS_TABLE_NAME: S3ServerAccessRow, + CISCO_UMBRELLA_TYPE: S3UmbrellaRow +} + +service_rows_map = { + 'cloudwatch_logs': ServiceCloudWatchRow, + 'aws_services': ServiceInspectorRow +} + + +def _get_s3_row_type(bucket_type): + """Get row type for bucket integration. + + Args: + bucket_type (str): The name of the bucket. + + Returns: + Type[S3CloudTrailRow]: The type that match or a default one. + """ + return s3_rows_map.get(bucket_type, S3CloudTrailRow) + + +def _get_service_row_type(table_name): + """Get row type for service integration. + + Args: + table_name (str): Table name to match. + + Returns: + Type[ServiceCloudWatchRow]: The type that match or a default one. + """ + return service_rows_map.get(table_name, ServiceCloudWatchRow) + + +def get_db_connection(path): + """Get an open DB connection. + + Args: + path (Path): The path of the sqlite file. + + Returns: + sqlite3.Connection: A connection with the specified DB. + """ + return sqlite3.connect(path) + + +def table_exists(table_name, db_path=S3_CLOUDTRAIL_DB_PATH): + """Check if the given table name exists. + + Args: + table_name (str): Table name to search for. + + Returns: + bool: True if exists else False. + """ + connection = get_db_connection(db_path) + cursor = connection.cursor() + query = """ + SELECT + name + FROM + sqlite_master + WHERE + type ='table' AND + name NOT LIKE 'sqlite_%'; + """ + + return table_name in [result[0] for result in cursor.execute(query).fetchall()] + + +# cloudtrail.db utils + + +def s3_db_exists(): + """Check if `s3_cloudtrail.db` exists. + + Returns: + bool: True if exists else False. + """ + return S3_CLOUDTRAIL_DB_PATH.exists() + + +def delete_s3_db() -> None: + """Delete `s3_cloudtrail.db` file.""" + if s3_db_exists(): + S3_CLOUDTRAIL_DB_PATH.unlink() + + +def get_s3_db_row(table_name) -> S3CloudTrailRow: + """Return one row from the given table name. + + Args: + table_name (str): Table name to search into. + + Returns: + S3CloudTrailRow: The first row of the table. + """ + connection = get_db_connection(S3_CLOUDTRAIL_DB_PATH) + cursor = connection.cursor() + result = cursor.execute(SELECT_QUERY_TEMPLATE.format(table_name=table_name)).fetchone() + row_type = _get_s3_row_type(table_name) + return row_type(*result) + + +def get_multiple_s3_db_row(table_name): + """Return all rows from the given table name. + + Args: + table_name (str): Table name to search into. + + Yields: + Iterator[S3CloudTrailRow]: All the rows in the table. + """ + connection = get_db_connection(S3_CLOUDTRAIL_DB_PATH) + cursor = connection.cursor() + row_type = _get_s3_row_type(table_name) + + for row in cursor.execute(SELECT_QUERY_TEMPLATE.format(table_name=table_name)): + yield row_type(*row) + + +def table_exists_or_has_values(table_name, db_path=S3_CLOUDTRAIL_DB_PATH): + """Check if the given table name exists. If exists check if has values. + + Args: + table_name (str): Table name to search for. + + Returns: + bool: True if exists or has values else False. + """ + connection = get_db_connection(db_path) + cursor = connection.cursor() + try: + return bool(cursor.execute(SELECT_QUERY_TEMPLATE.format(table_name=table_name)).fetchall()) + except sqlite3.OperationalError: + return False + + +# aws_services.db utils + +def services_db_exists(): + """Check if `aws_services.db` exists. + + Returns: + bool: True if exists else False. + """ + return AWS_SERVICES_DB_PATH.exists() + + +def delete_services_db() -> None: + """Delete `aws_services.db` file.""" + if services_db_exists(): + AWS_SERVICES_DB_PATH.unlink() + + +def get_service_db_row(table_name): + """Return one row from the given table name. + + Args: + table_name (str): Table name to search into. + + Returns: + ServiceInspectorRow: The first row of the table. + """ + row_type = _get_service_row_type(table_name) + connection = get_db_connection(AWS_SERVICES_DB_PATH) + cursor = connection.cursor() + result = cursor.execute(SELECT_QUERY_TEMPLATE.format(table_name=table_name)).fetchone() + + return row_type(*result) + + +def get_multiple_service_db_row(table_name): + """Return all rows from the given table name. + + Args: + table_name (str): Table name to search into. + + Yields: + Iterator[ServiceInspectorRow]: All the rows in the table. + """ + row_type = _get_service_row_type(table_name) + connection = get_db_connection(AWS_SERVICES_DB_PATH) + cursor = connection.cursor() + + for row in cursor.execute(SELECT_QUERY_TEMPLATE.format(table_name=table_name)): + yield row_type(*row) diff --git a/deps/wazuh_testing/wazuh_testing/modules/aws/event_monitor.py b/deps/wazuh_testing/wazuh_testing/modules/aws/event_monitor.py new file mode 100644 index 0000000000..757481ee78 --- /dev/null +++ b/deps/wazuh_testing/wazuh_testing/modules/aws/event_monitor.py @@ -0,0 +1,329 @@ +import re + +from wazuh_testing.modules.aws import VPC_FLOW_TYPE +from wazuh_testing.modules.aws.cli_utils import analyze_command_output + +PARSER_ERROR = r'.*wm_aws_read\(\): ERROR:.*' +MODULE_ERROR = r'.*wm_aws_run_s3\(\): ERROR: .*' +AWS_EVENT_HEADER = b'1:Wazuh-AWS:' + + +def make_aws_callback(pattern, prefix=''): + """Create a callback function from a text pattern. + + Args: + pattern (str): String to match on the log. + prefix (str): Regular expression used as prefix before the pattern. + + Returns: + lambda: Function that returns if there's a match in the file. + """ + pattern = r'\s+'.join(pattern.split()) + regex = re.compile(r'{}{}'.format(prefix, pattern)) + + return lambda line: regex.match(line) + + +def callback_detect_aws_module_called(parameters): + """Detect if aws module was called with correct parameters. + + Args: + parameters (list): Values to check. + + Returns: + Callable: Callback to match the line. + """ + regex = re.compile(fr'.*DEBUG: Launching S3 Command: {" ".join(parameters)}\n*') + return lambda line: regex.match(line) + + +def callback_detect_aws_error_for_missing_type(line): + """Detect if the AWS module displays an error about missing type. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: Line if it matches. + """ + + if re.match( + r".*ERROR: Undefined type for service.", line + ): + return line + + +def callback_detect_aws_legacy_module_warning(line): + """Detect if the AWS module displays a warning about legacy config. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: Line if it matches. + """ + + if re.match( + r".*WARNING: Deprecated config defined; please use current config definition at module 'aws-s3'.", line + ): + return line + + +def callback_detect_aws_module_warning(line): + """Detect if the AWS module displays a warning. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: Line if it matches. + """ + + if re.match(r".*WARNING: No buckets or services definitions found at module 'aws-s3'.", line): + return line + + +def callback_detect_aws_module_started(line): + """Detect if the AWS module was called. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: Line if it matches. + """ + + if re.match(r'.*DEBUG: Launching S3 Command: .*', line): + return line + + +def callback_detect_aws_empty_value(line): + """Detect if the AWS module displays a message about an empty value. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: Line if it matches. + """ + + if ( + re.match(r".*ERROR: Invalid \w+ type ''", line) or + re.match(r".*ERROR: Empty content for tag '\w+' at module 'aws-s3'.", line) or + re.match(r".*WARNING: Empty content for tag '\w+' at module 'aws-s3'.", line) + ): + return line + + +def callback_detect_aws_invalid_value(line): + """Detect if the AWS module displays a message about an invalid value. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: Line if it matches. + """ + + if ( + re.match(r".*ERROR: Invalid \w+ type '\w+'.*", line) or + re.match(r'.*ERROR: Invalid content for tag*', line) or + re.match(r'.*WARNING: Bucket: - Error parsing arguments.*', line), + re.match(r'.*WARNING: Service: - Error parsing arguments.*', line) + ): + return line + + +def callback_detect_bucket_or_service_call(line): + """Detect if bucket or service module was called. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: Line if it match. + """ + + if ( + re.match(r".*INFO: Executing Service Analysis:*", line) or + re.match(r'.*INFO: Executing Bucket Analysis:*', line) + ): + return line + + +def callback_detect_aws_module_start(line): + """Search for start message in the given line. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: Line if it match. + """ + + if re.match(r'.*INFO: Module AWS started*', line): + return line + + +def callback_detect_all_aws_err(line): + """Search for parse or module error message in the given line. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: line if it match. + """ + if re.match(PARSER_ERROR, line) or re.match(MODULE_ERROR, line): + return line + + +def callback_detect_aws_read_err(line): + """Search for parser error message in the given line. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: line if it match. + """ + if re.match(PARSER_ERROR, line): + return line + + +def callback_detect_aws_wmodule_err(line): + """Search for module error message in the given line. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: line if it match. + """ + if re.match(MODULE_ERROR, line): + return line + + +def callback_detect_event_processed(line): + """Search for event processed message in the given line. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: line if it match. + """ + if re.match(r'.*Found new log: .*', line): + return line + + +def callback_detect_event_processed_or_skipped(pattern): + """Search for event processed or skipped message in the given line. + + Args: + pattern (str): Pattern to match in line. + Returns: + Callable: Callback to match the given line. + """ + pattern_regex = re.compile(pattern) + return lambda line: pattern_regex.match(line) or callback_detect_event_processed(line) + + +def callback_detect_service_event_processed(expected_results, service_type): + if service_type == 'inspector': + regex = re.compile(fr"DEBUG: \+\+\+ {expected_results} events collected and processed in") + else: + regex = re.compile(fr'DEBUG: \+\+\+ Sent {expected_results} events to Analysisd') + return lambda line: regex.match(line) + + +def callback_event_sent_to_analysisd(line): + """Search for module header message in the given line. + + Args: + line (str): Line to match. + + Returns: + Optional[str]: line if it match. + """ + if line.startswith(AWS_EVENT_HEADER): + return line + + +def check_processed_logs_from_output(command_output, expected_results=1): + """Check for processed messages in the give output. + + Args: + command_output (str): Output to analyze. + expected_results (int, optional): Number of results to find. Defaults to 1. + """ + analyze_command_output( + command_output=command_output, + callback=callback_detect_event_processed, + expected_results=expected_results, + error_message='The AWS module did not process the expected number of events' + ) + + +def check_non_processed_logs_from_output(command_output, bucket_type, expected_results=1): + """Check for non processed messages in the give output. + + Args: + command_output (str): Output to analyze. + bucket_type (str): Bucket type to select the message. + expected_results (int, optional): Number of results to find. Defaults to 1. + """ + if bucket_type == VPC_FLOW_TYPE: + pattern = r'.*DEBUG: \+\+\+ No logs to process for .*' + else: + pattern = r'.*DEBUG: \+\+\+ No logs to process in bucket: ' + + analyze_command_output( + command_output, + callback=make_aws_callback(pattern), + expected_results=expected_results, + error_message='Some logs may were processed or the results found are more than expected' + ) + + +def check_marker_from_output(command_output, file_key, expected_results=1): + """Check for marker message in the given output. + + Args: + command_output (str): Output to analyze. + file_key (str): Value to check as a marker. + expected_results (int, optional): Number of results to find. Defaults to 1. + """ + pattern = fr".*DEBUG: \+\+\+ Marker: {file_key}" + + analyze_command_output( + command_output, + callback=make_aws_callback(pattern), + expected_results=expected_results, + error_message='The AWS module did not use the correct marker' + ) + + +def check_service_processed_logs_from_output( + command_output, events_sent, service_type, expected_results=1 +): + analyze_command_output( + command_output=command_output, + callback=callback_detect_service_event_processed(events_sent, service_type), + expected_results=expected_results, + error_message='The AWS module did not process the expected number of events' + ) + + +def check_service_non_processed_logs_from_output(command_output, service_type, expected_results=1): + if service_type == 'inspector': + pattern = r'DEBUG: \+\+\+ There are no new events in .*' + else: + pattern = r'DEBUG: \+\+\+ Sent \d+ events to Analysisd' + + analyze_command_output( + command_output, + callback=make_aws_callback(pattern), + expected_results=expected_results, + error_message='Some logs may were processed' + ) diff --git a/deps/wazuh_testing/wazuh_testing/modules/aws/exceptions.py b/deps/wazuh_testing/wazuh_testing/modules/aws/exceptions.py new file mode 100644 index 0000000000..a350d97621 --- /dev/null +++ b/deps/wazuh_testing/wazuh_testing/modules/aws/exceptions.py @@ -0,0 +1,2 @@ +class OutputAnalysisError(Exception): + pass diff --git a/deps/wazuh_testing/wazuh_testing/modules/aws/s3_utils.py b/deps/wazuh_testing/wazuh_testing/modules/aws/s3_utils.py new file mode 100644 index 0000000000..187707e5aa --- /dev/null +++ b/deps/wazuh_testing/wazuh_testing/modules/aws/s3_utils.py @@ -0,0 +1,89 @@ +"""AWS S3 related utils""" + +import gzip + +import boto3 +from botocore.exceptions import ClientError +from wazuh_testing import logger +from wazuh_testing.modules.aws.data_generator import get_data_generator + +session = boto3.Session(profile_name='qa') +s3 = session.resource('s3') + + +def upload_file(bucket_type, bucket_name): + """Upload a file to an S3 bucket. + + Args: + bucket_type (str): Bucket type to generate the data. + bucket_name (str): Bucket to upload. + + Returns: + str: The name of the file if was uploaded, else ''. + """ + dg = get_data_generator(bucket_type, bucket_name) + filename = dg.get_filename() + obj = s3.Object(bucket_name, filename) + + data = dg.get_data_sample().encode() if not dg.compress else gzip.compress(data=dg.get_data_sample().encode()) + + # Upload the file + try: + obj.put(Body=data) + except ClientError as e: + logger.error(e) + filename = '' + return filename + + +def delete_file(filename, bucket_name): + """Delete a given file from the bucket. + + Args: + filename (str): Full filename to delete. + bucket_name (str): Bucket that contains the file. + """ + s3.Object(bucket_name, filename).delete() + + +def file_exists(filename, bucket_name): + """Check if a file exists in a bucket. + + Args: + filename (str): Full filename to check. + bucket_name (str): Bucket that contains the file. + Returns: + bool: True if exists else False. + """ + exists = True + try: + s3.Object(bucket_name, filename).load() + except ClientError as error: + if error.response['Error']['Code'] == '404': + exists = False + + return exists + + +def get_last_file_key(bucket_type, bucket_name, execution_datetime): + """Return the last file key contained in a default path of a bucket. + + Args: + bucket_type (str): Bucket type to obtain the data generator. + bucket_name (str): Bucket that contains the file. + execution_datetime (datetime): Datetime to use to use as prefix. + + Returns: + str: The last key in the bucket. + """ + + dg = get_data_generator(bucket_type, bucket_name) + bucket = s3.Bucket(bucket_name) + last_key = None + + try: + *_, last_item = bucket.objects.filter(Prefix=dg.BASE_PATH or str(execution_datetime.year)) + last_key = last_item.key + except ValueError: + last_key = '' + return last_key diff --git a/deps/wazuh_testing/wazuh_testing/tools/utils.py b/deps/wazuh_testing/wazuh_testing/tools/utils.py index 346bfddb87..3a623f4648 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/utils.py +++ b/deps/wazuh_testing/wazuh_testing/tools/utils.py @@ -115,6 +115,15 @@ def get_random_ip(): return fr"{randint(0,255)}.{randint(0,255)}.{randint(0,255)}.{randint(0,255)}" +def get_random_port() -> str: + """Create a port number. + + Return: + String: Random port number. + """ + return f"{randint(0, 10000)}" + + def get_random_string(string_length, digits=True): """Create a random string with specified length. @@ -161,13 +170,14 @@ def get_host_name(): def validate_interval_format(interval): """Validate that the interval passed has the format in which the last digit is a letter from those passed and - the other characters are between 0-9""" - if interval=='': + the other characters are between 0-9.""" + if interval == '': return False - if interval[-1] not in ['s','m', 'h','d','w','y'] or not isinstance(int(interval[0:-1]), numbers.Number): + if interval[-1] not in ['s', 'm', 'h', 'd', 'w', 'y'] or not isinstance(int(interval[0:-1]), numbers.Number): return False return True + def format_ipv6_long(ipv6_address): """Return the long form of the address representation in uppercase. diff --git a/requirements.txt b/requirements.txt index 336cfa1080..92f341ddb2 100644 --- a/requirements.txt +++ b/requirements.txt @@ -50,3 +50,4 @@ treelib==1.6.1 prettytable; platform_system == "Linux" mysql-connector-python==8.0.32; platform_system == 'Linux' and python_version >= '3.7' protobuf>=3.11.0,<=3.20.3; platform_system == 'Linux' and python_version >= '3.7' +boto3==1.26.11; platform_system == 'Linux' diff --git a/tests/integration/README.md b/tests/integration/README.md index d61a0a22ae..6a1d804772 100644 --- a/tests/integration/README.md +++ b/tests/integration/README.md @@ -154,6 +154,7 @@ Our newest integration tests are located in `wazuh-qa/tests/integration/`. They - _test_analysisd_ - _test_api_ - _test_authd_ +- _test_aws_ - _test_enrollment_ - _test_fim_ - _test_gcloud_ @@ -399,9 +400,9 @@ python3 -m pytest [options] [file_or_dir] [file_or_dir] [...] - `--wpk_version`: Specify the WPK package version used to upgrade on WPK tests. (ex. --wpk_version=v4.2.0). Note: This field is required to execute any WPK test and the WPK package must be previously created in the [repository](packages-dev.wazuh.com/trash/wpk/). -- `--wpk_package_path`: Specify the WPK package path used to upgrade on WPK tests. (ex. --wpk_package_path='packages-dev.wazuh.com/trash/wpk/'). +- `--wpk_package_path`: Specify the WPK package path used to upgrade on WPK tests. (ex. --wpk_package_path='packages-dev.wazuh.com/trash/wpk/'). This field is required to execute any WPK test. -- `--save-file`: Specify the files of execution of the tests that you need to download. (ex. --save-file=archives.json). +- `--save-file`: Specify the files of execution of the tests that you need to download. (ex. --save-file=archives.json). If the file does not exist while the test was executed, the test will run without problems but not save this file in the report. _Use `-h` to see the rest or check its [documentation](https://docs.pytest.org/en/latest/usage.html)._ diff --git a/tests/integration/test_aws/README.md b/tests/integration/test_aws/README.md new file mode 100644 index 0000000000..f06aac5e54 --- /dev/null +++ b/tests/integration/test_aws/README.md @@ -0,0 +1,180 @@ +# AWS Integration + +## Description + +It is a _wodle based_ module that has a capability to pull logs from several AWS services. + +## Tests directory structure + +```bash +wazuh-qa/tests/integration/test_aws +├── conftest.py +├── data +│   ├── configuration_template +│   │   ├── basic_test_module +│   │   ├── discard_regex_test_module +│   │   ├── only_logs_after_test_module +│   │   ├── path_suffix_test_module +│   │   ├── path_test_module +│   │   ├── regions_test_module +│   │   └── remove_from_bucket_test_module +│   └── test_cases +│   ├── basic_test_module +│   ├── discard_regex_test_module +│   ├── only_logs_after_test_module +│   ├── path_suffix_test_module +│   ├── path_test_module +│   ├── regions_test_module +│   └── remove_from_bucket_test_module +├── README.MD +├── test_basic.py +├── test_discard_regex.py +├── test_only_logs_after.py +├── test_path.py +├── test_path_suffix.py +├── test_regions.py +└── test_remove_from_bucket.py +``` + +## Deps directory structure + +```bash +wazuh-qa/deps/wazuh_testing/wazuh_testing/modules/aws +├── cli_utils.py +├── constants.py +├── data_generator.py +├── db_utils.py +├── event_monitor.py +├── __init__.py +└── s3_utils.py +``` + +## Requirements + +- The only extra dependency is `boto3` +- The module will assume there are already buckets, log groups and an inspector assessment with test data in AWS. + +## Configuration settings + +- **credentials** + Set the credentials at `$HOME/.aws/credentials` (being `HOME` the home directory of the user who runs the tests, more information [here](https://documentation.wazuh.com/current/amazon/services/prerequisites/credentials.html#profiles)) with the content: + +```ini +[qa] +aws_access_key_id = +aws_secret_access_key = +``` + +## Setting up a test environment + +You will need a proper environment to run the integration tests. You can use any virtual machine you wish. If you have +one already, go to the [integration tests section](#integration-tests) + +If you use [Vagrant](https://www.vagrantup.com/downloads.html) +or [VirtualBox](https://www.virtualbox.org/wiki/Downloads), it is important to install the `vbguest` plugin since some +tests modify the system date and there could be some synchronization issues. + +This guide will cover the following platforms: [Linux](#linux). + +You can run these tests on a manager or an agent. In case you are using an agent, please remember to register it and use +the correct version (Wazuh branch). + +_We are skipping Wazuh installation steps. For further information, +check [Wazuh documentation](https://documentation.wazuh.com/current/installation-guide/index.html)._ + +### Linux + +_We are using **Ubuntu 22.04** for this example:_ + +- Install **Wazuh** + +- Install python tests dependencies: + + ```shell script + # Install pip + apt install python3-pip + + # Clone your `wazuh-qa` repository within your testing environment + cd wazuh-qa + + # Install Python libraries + python3 -m pip install -r requirements.txt + + # Install test dependecies + python3 -m pip install deps/wazuh-testing + ``` + + +## Integration tests + +**DISCLAIMER:** this guide assumes you have a proper testing environment. If you do not, please check +our [testing environment guide](#setting-up-a-test-environment). + +### Pytest + +We use [pytest](https://docs.pytest.org/en/latest/contents.html) to run our integrity tests. Pytest will recursively +look for the closest `conftest` to import all the variables and fixtures needed for every test. If something is lacking +from the closest one, it will look for the next one (if possible) until reaching the current directory. This means we +need to run every test from the following path, where the general _conftest_ is: + +```shell script +cd wazuh-qa/tests/integration +``` + +To run any test, we just need to call `pytest` from `python3` using the following line: + +```shell script +python3 -m pytest [options] [file_or_dir] [file_or_dir] [...] +``` + +**Options:** + +- `v`: verbosity level (-v or -vv. Highly recommended to use -vv when tests are failing) +- `s`: shortcut for --capture=no. This will show the output in real time +- `x`: instantly exit after the first error. Very helpful when using a log truncate since it will keep the last failed + result +- `k`: only run tests which match the given substring expression (-k EXPRESSION) +- `m`: only run tests matching given expression (-m MARKEXPR) +- `--tier`: only run tests with given tier (ex. --tier 2) +- `--html`: generates a HTML report for the test results. (ex. --html=report.html) +- `--default-timeout`: overwrites the default timeout (in seconds). This value is used to make a test fail if a + condition is not met before the given time lapse. Some tests make use of this value and other has other fixed timeout + that cannot be modified. + +_Use `-h` to see the rest or check its [documentation](https://docs.pytest.org/en/latest/usage.html)._ + +Also, these integration tests are heavily based on [fixtures](https://docs.pytest.org/en/latest/fixture.html), so please +check its documentation for further information. + +#### AWS integration tests example + +```bash +# python3 -m pytest -vvx test_aws/ -k cloudtrail +=========================================================== test session starts ====================================================== +platform linux -- Python 3.10.6, pytest-7.1.2, pluggy-1.0.0 -- /usr/bin/python3 +cachedir: .pytest_cache +metadata: {'Python': '3.10.6', 'Platform': 'Linux-5.15.0-58-generic-x86_64-with-glibc2.35', +'Packages': {'pytest': '7.1.2', 'py': '1.10.0', 'pluggy': '1.0.0'}, +'Plugins': {'metadata': '2.0.2', 'html': '3.1.1', 'testinfra': '5.0.0'}} +rootdir: /home/vagrant/qa/tests/integration, configfile: pytest.ini +plugins: metadata-2.0.2, html-3.1.1, testinfra-5.0.0 +collected 15 items + +test_aws/test_basic.py::test_defaults[cloudtrail_defaults] PASSED [ 6%] +test_aws/test_discard_regex.py::test_discard_regex[cloudtrail_discard_regex] PASSED [ 13%] +test_aws/test_only_logs_after.py::test_without_only_logs_after[cloudtrail_without_only_logs_after] PASSED [ 20%] +test_aws/test_only_logs_after.py::test_with_only_logs_after[cloudtrail_with_only_logs_after] PASSED [ 26%] +test_aws/test_only_logs_after.py::test_multiple_calls[cloudtrail_only_logs_after_multiple_calls] PASSED [ 33%] +test_aws/test_path.py::test_path[cloudtrail_path_with_data] PASSED [ 40%] +test_aws/test_path.py::test_path[cloudtrail_path_without_data] PASSED [ 46%] +test_aws/test_path.py::test_path[cloudtrail_inexistent_path] PASSED [ 53%] +test_aws/test_path_suffix.py::test_path_suffix[cloudtrail_path_suffix_with_data] PASSED [ 60%] +test_aws/test_path_suffix.py::test_path_suffix[cloudtrail_path_suffix_without_data] PASSED [ 66%] +test_aws/test_path_suffix.py::test_path_suffix[cloudtrail_inexistent_path_suffix] PASSED [ 73%] +test_aws/test_regions.py::test_regions[cloudtrail_region_with_data] PASSED [ 80%] +test_aws/test_regions.py::test_regions[cloudtrail_regions_with_data] PASSED [ 86%] +test_aws/test_regions.py::test_regions[cloudtrail_inexistent_region] PASSED [ 93%] +test_aws/test_remove_from_bucket.py::test_remove_from_bucket[cloudtrail_remove_from_bucket] PASSED [100%] + +=============================================== 15 passed, 2 warnings in 332.67s (0:05:32) =========================================== +``` diff --git a/tests/integration/test_aws/conftest.py b/tests/integration/test_aws/conftest.py new file mode 100644 index 0000000000..88dec5e0b4 --- /dev/null +++ b/tests/integration/test_aws/conftest.py @@ -0,0 +1,161 @@ +import pytest +from wazuh_testing import logger +from wazuh_testing.modules.aws import ( + FAKE_CLOUDWATCH_LOG_GROUP, + PERMANENT_CLOUDWATCH_LOG_GROUP, +) +from wazuh_testing.modules.aws.cloudwatch_utils import ( + create_log_events, + create_log_group, + create_log_stream, + delete_log_group, + delete_log_stream, +) +from wazuh_testing.modules.aws.db_utils import delete_s3_db, delete_services_db +from wazuh_testing.modules.aws.s3_utils import delete_file, file_exists, upload_file +from wazuh_testing.tools.services import control_service + + +@pytest.fixture +def mark_cases_as_skipped(metadata): + if metadata['name'] in ['alb_remove_from_bucket', 'clb_remove_from_bucket', 'nlb_remove_from_bucket']: + pytest.skip(reason='ALB, CLB and NLB integrations are removing older logs from other region') + + +@pytest.fixture +def restart_wazuh_function_without_exception(daemon=None): + """Restart all Wazuh daemons.""" + try: + control_service("start", daemon=daemon) + except ValueError: + pass + + yield + + control_service('stop', daemon=daemon) + + +# S3 fixtures + +@pytest.fixture +def upload_and_delete_file_to_s3(metadata): + """Upload a file to S3 bucket and delete after the test ends. + + Args: + metadata (dict): Metadata to get the parameters. + """ + bucket_name = metadata['bucket_name'] + filename = upload_file(bucket_type=metadata['bucket_type'], bucket_name=metadata['bucket_name']) + if filename != '': + logger.debug('Uploaded file: %s to bucket "%s"', filename, bucket_name) + metadata['uploaded_file'] = filename + + yield + + if file_exists(filename=filename, bucket_name=bucket_name): + delete_file(filename=filename, bucket_name=bucket_name) + logger.debug('Deleted file: %s from bucket %s', filename, bucket_name) + + +@pytest.fixture +def delete_file_from_s3(metadata): + """Delete a file from S3 bucket after the test ends. + + Args: + metadata (dict): Metadata to get the parameters. + """ + yield + + bucket_name = metadata['bucket_name'] + filename = metadata.get('filename') + if filename is not None: + delete_file(filename=filename, bucket_name=bucket_name) + logger.debug('Deleted file: %s from bucket %s', filename, bucket_name) + + +# CloudWatch fixtures + +@pytest.fixture(name='create_log_stream') +def fixture_create_log_stream(metadata): + """Create a log stream with events and delete after the execution. + + Args: + metadata (dict): Metadata to get the parameters. + """ + SKIP_LOG_GROUP_CREATION = [PERMANENT_CLOUDWATCH_LOG_GROUP, FAKE_CLOUDWATCH_LOG_GROUP] + log_group_names = [item.strip() for item in metadata['log_group_name'].split(',')] + for log_group_name in log_group_names: + if log_group_name in SKIP_LOG_GROUP_CREATION: + continue + logger.debug('Creating log group: %s', log_group_name) + create_log_group(log_group_name) + log_stream = create_log_stream(log_group_name) + logger.debug('Created log stream "%s" within log group "%s"', log_stream, log_group_name) + create_log_events( + log_stream=log_stream, log_group=log_group_name, event_number=metadata.get('expected_results', 1) + ) + logger.debug('Created log events') + metadata['log_stream'] = log_stream + + yield + + for log_group_name in log_group_names: + if log_group_name in SKIP_LOG_GROUP_CREATION: + continue + delete_log_group(log_group_name) + logger.debug('Deleted log group: %s', log_group_name) + + +@pytest.fixture +def create_log_stream_in_existent_group(metadata): + """Create a log stream with events and delete after the execution. + + Args: + metadata (dict): Metadata to get the parameters. + """ + log_group_name = metadata['log_group_name'] + log_stream = create_log_stream(log_group_name) + logger.debug('Created log stream "%s" within log group "%s"', log_stream, log_group_name) + create_log_events(log_stream=log_stream, log_group=log_group_name) + logger.debug('Created log events') + metadata['log_stream'] = log_stream + + yield + + delete_log_stream(log_stream=log_stream, log_group=log_group_name) + logger.debug('Deleted log stream: %s', log_stream) + + +@pytest.fixture(name='delete_log_stream') +def fixture_delete_log_stream(metadata): + """Create a log stream with events and delete after the execution. + + Args: + metadata (dict): Metadata to get the parameters. + """ + yield + log_stream = metadata['log_stream'] + delete_log_stream(log_stream=log_stream) + logger.debug('Deleted log stream: %s', log_stream) + +# DB fixtures + + +@pytest.fixture +def clean_s3_cloudtrail_db(): + """Delete the DB file before and after the test execution""" + delete_s3_db() + + yield + + delete_s3_db() + + +@pytest.fixture +def clean_aws_services_db(): + """Delete the DB file before and after the test execution.""" + delete_services_db() + + yield + + delete_services_db() diff --git a/tests/integration/test_aws/data/configuration_template/basic_test_module/bucket_configuration_defaults.yaml b/tests/integration/test_aws/data/configuration_template/basic_test_module/bucket_configuration_defaults.yaml new file mode 100644 index 0000000000..507a734e36 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/basic_test_module/bucket_configuration_defaults.yaml @@ -0,0 +1,15 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - bucket: + attributes: + - type: BUCKET_TYPE + elements: + - aws_profile: + value: qa + - name: + value: BUCKET_NAME diff --git a/tests/integration/test_aws/data/configuration_template/basic_test_module/cloudwatch_configuration_defaults.yaml b/tests/integration/test_aws/data/configuration_template/basic_test_module/cloudwatch_configuration_defaults.yaml new file mode 100644 index 0000000000..6fc76e6537 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/basic_test_module/cloudwatch_configuration_defaults.yaml @@ -0,0 +1,17 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - service: + attributes: + - type: SERVICE_TYPE + elements: + - aws_profile: + value: qa + - aws_log_groups: + value: LOG_GROUP_NAME + - regions: + value: us-east-1 diff --git a/tests/integration/test_aws/data/configuration_template/basic_test_module/inspector_configuration_defaults.yaml b/tests/integration/test_aws/data/configuration_template/basic_test_module/inspector_configuration_defaults.yaml new file mode 100644 index 0000000000..2b6c6bd043 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/basic_test_module/inspector_configuration_defaults.yaml @@ -0,0 +1,15 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - service: + attributes: + - type: SERVICE_TYPE + elements: + - aws_profile: + value: qa + - regions: + value: us-east-1 diff --git a/tests/integration/test_aws/data/configuration_template/discard_regex_test_module/configuration_discard_regex.yaml b/tests/integration/test_aws/data/configuration_template/discard_regex_test_module/configuration_discard_regex.yaml new file mode 100644 index 0000000000..cd7e6175e8 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/discard_regex_test_module/configuration_discard_regex.yaml @@ -0,0 +1,23 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - bucket: + attributes: + - type: BUCKET_TYPE + elements: + - aws_profile: + value: qa + - name: + value: BUCKET_NAME + - only_logs_after: + value: 2022-NOV-20 + - path: + value: PATH + - discard_regex: + attributes: + - field: DISCARD_FIELD + value: DISCARD_REGEX diff --git a/tests/integration/test_aws/data/configuration_template/log_groups_test_module/configuration_log_groups.yaml b/tests/integration/test_aws/data/configuration_template/log_groups_test_module/configuration_log_groups.yaml new file mode 100644 index 0000000000..17585a7f2d --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/log_groups_test_module/configuration_log_groups.yaml @@ -0,0 +1,19 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - service: + attributes: + - type: SERVICE_TYPE + elements: + - aws_profile: + value: qa + - aws_log_groups: + value: LOG_GROUP_NAME + - only_logs_after: + value: 2023-JAN-12 + - regions: + value: us-east-1 diff --git a/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/bucket_configuration_with_only_logs_after.yaml b/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/bucket_configuration_with_only_logs_after.yaml new file mode 100644 index 0000000000..1ccc03ee92 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/bucket_configuration_with_only_logs_after.yaml @@ -0,0 +1,19 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: "no" + - bucket: + attributes: + - type: BUCKET_TYPE + elements: + - aws_profile: + value: qa + - name: + value: BUCKET_NAME + - only_logs_after: + value: ONLY_LOGS_AFTER + - path: + value: PATH diff --git a/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/bucket_configuration_without_only_logs_after.yaml b/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/bucket_configuration_without_only_logs_after.yaml new file mode 100644 index 0000000000..0821bb0b8f --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/bucket_configuration_without_only_logs_after.yaml @@ -0,0 +1,17 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: "no" + - bucket: + attributes: + - type: BUCKET_TYPE + elements: + - aws_profile: + value: qa + - name: + value: BUCKET_NAME + - path: + value: PATH diff --git a/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/cloudwatch_configuration_with_only_logs_after.yaml b/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/cloudwatch_configuration_with_only_logs_after.yaml new file mode 100644 index 0000000000..5eacd69893 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/cloudwatch_configuration_with_only_logs_after.yaml @@ -0,0 +1,19 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: "no" + - service: + attributes: + - type: SERVICE_TYPE + elements: + - aws_profile: + value: qa + - aws_log_groups: + value: LOG_GROUP_NAME + - only_logs_after: + value: ONLY_LOGS_AFTER + - regions: + value: us-east-1 diff --git a/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/inspector_configuration_with_only_logs_after.yaml b/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/inspector_configuration_with_only_logs_after.yaml new file mode 100644 index 0000000000..d88be0bb12 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/inspector_configuration_with_only_logs_after.yaml @@ -0,0 +1,17 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: "no" + - service: + attributes: + - type: SERVICE_TYPE + elements: + - aws_profile: + value: qa + - only_logs_after: + value: ONLY_LOGS_AFTER + - regions: + value: us-east-1 diff --git a/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/service_configuration_without_only_logs_after.yaml b/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/service_configuration_without_only_logs_after.yaml new file mode 100644 index 0000000000..c16c07ec92 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/only_logs_after_test_module/service_configuration_without_only_logs_after.yaml @@ -0,0 +1,17 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: "no" + - service: + attributes: + - type: SERVICE_TYPE + elements: + - aws_profile: + value: qa + - aws_log_groups: + value: LOG_GROUP_NAME + - regions: + value: us-east-1 diff --git a/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_bucket_and_service_missing.yaml b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_bucket_and_service_missing.yaml new file mode 100644 index 0000000000..818a192d1a --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_bucket_and_service_missing.yaml @@ -0,0 +1,7 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' diff --git a/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_multiple_bucket_and_service_tags.yaml b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_multiple_bucket_and_service_tags.yaml new file mode 100644 index 0000000000..645fed742c --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_multiple_bucket_and_service_tags.yaml @@ -0,0 +1,47 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - bucket: + attributes: + - type: cloudtrail + elements: + - aws_profile: + value: qa + - name: + value: wazuh-cloudtrail-integration-tests + - regions: + value: us-east-1 + - bucket: + attributes: + - type: cloudtrail + elements: + - aws_profile: + value: qa + - name: + value: wazuh-cloudtrail-integration-tests + - regions: + value: us-east-2 + - service: + attributes: + - type: cloudwatchlogs + elements: + - aws_profile: + value: qa + - aws_log_groups: + value: wazuh-cloudwatchlogs-integration-tests + - regions: + value: us-east-1 + - service: + attributes: + - type: cloudwatchlogs + elements: + - aws_profile: + value: qa + - aws_log_groups: + value: wazuh-cloudwatchlogs-integration-tests + - regions: + value: us-east-2 diff --git a/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_type_missing_in_bucket.yaml b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_type_missing_in_bucket.yaml new file mode 100644 index 0000000000..36cb9d2c6d --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_type_missing_in_bucket.yaml @@ -0,0 +1,13 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - bucket: + elements: + - aws_profile: + value: qa + - name: + value: wazuh-cloudtrail-integration-tests diff --git a/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_type_missing_in_service.yaml b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_type_missing_in_service.yaml new file mode 100644 index 0000000000..2a5e06849b --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_type_missing_in_service.yaml @@ -0,0 +1,13 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - service: + elements: + - aws_profile: + value: qa + - name: + aws_log_groups: wazuh-cloudwatch-integration-tests diff --git a/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_values_in_bucket.yaml b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_values_in_bucket.yaml new file mode 100644 index 0000000000..5f433bbfa3 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_values_in_bucket.yaml @@ -0,0 +1,25 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - bucket: + attributes: + - type: BUCKET_TYPE + elements: + - aws_profile: + value: qa + - name: + value: BUCKET_NAME + - only_logs_after: + value: ONLY_LOGS_AFTER + - regions: + value: REGIONS + - path: + value: PATH + - path_suffix: + value: PATH_SUFFIX + - remove_from_bucket: + value: REMOVE_FROM_BUCKET diff --git a/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_values_in_service.yaml b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_values_in_service.yaml new file mode 100644 index 0000000000..1d8c91c7d3 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/parser_test_module/configuration_values_in_service.yaml @@ -0,0 +1,21 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - service: + attributes: + - type: SERVICE_TYPE + elements: + - aws_profile: + value: qa + - aws_log_groups: + value: LOG_GROUPS + - only_logs_after: + value: ONLY_LOGS_AFTER + - regions: + value: REGIONS + - remove_log_streams: + value: REMOVE_LOG_STREAMS diff --git a/tests/integration/test_aws/data/configuration_template/path_suffix_test_module/configuration_path_suffix.yaml b/tests/integration/test_aws/data/configuration_template/path_suffix_test_module/configuration_path_suffix.yaml new file mode 100644 index 0000000000..7b76a2dc22 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/path_suffix_test_module/configuration_path_suffix.yaml @@ -0,0 +1,19 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - bucket: + attributes: + - type: BUCKET_TYPE + elements: + - aws_profile: + value: qa + - name: + value: BUCKET_NAME + - only_logs_after: + value: 2022-NOV-20 + - path_suffix: + value: PATH_SUFFIX diff --git a/tests/integration/test_aws/data/configuration_template/path_test_module/configuration_path.yaml b/tests/integration/test_aws/data/configuration_template/path_test_module/configuration_path.yaml new file mode 100644 index 0000000000..62b5aaff26 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/path_test_module/configuration_path.yaml @@ -0,0 +1,19 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - bucket: + attributes: + - type: BUCKET_TYPE + elements: + - aws_profile: + value: qa + - name: + value: BUCKET_NAME + - only_logs_after: + value: 2022-NOV-20 + - path: + value: PATH diff --git a/tests/integration/test_aws/data/configuration_template/regions_test_module/bucket_configuration_regions.yaml b/tests/integration/test_aws/data/configuration_template/regions_test_module/bucket_configuration_regions.yaml new file mode 100644 index 0000000000..45b8fcb404 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/regions_test_module/bucket_configuration_regions.yaml @@ -0,0 +1,19 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - bucket: + attributes: + - type: BUCKET_TYPE + elements: + - aws_profile: + value: qa + - name: + value: BUCKET_NAME + - only_logs_after: + value: 2022-NOV-20 + - regions: + value: REGIONS diff --git a/tests/integration/test_aws/data/configuration_template/regions_test_module/cloudwatch_configuration_regions.yaml b/tests/integration/test_aws/data/configuration_template/regions_test_module/cloudwatch_configuration_regions.yaml new file mode 100644 index 0000000000..f6c2b339ac --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/regions_test_module/cloudwatch_configuration_regions.yaml @@ -0,0 +1,19 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - service: + attributes: + - type: SERVICE_TYPE + elements: + - aws_profile: + value: qa + - aws_log_groups: + value: LOG_GROUP_NAME + - only_logs_after: + value: 2023-JAN-12 + - regions: + value: REGIONS diff --git a/tests/integration/test_aws/data/configuration_template/regions_test_module/inspector_configuration_regions.yaml b/tests/integration/test_aws/data/configuration_template/regions_test_module/inspector_configuration_regions.yaml new file mode 100644 index 0000000000..ca344fac2e --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/regions_test_module/inspector_configuration_regions.yaml @@ -0,0 +1,17 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - service: + attributes: + - type: SERVICE_TYPE + elements: + - aws_profile: + value: qa + - only_logs_after: + value: 2023-JAN-12 + - regions: + value: REGIONS diff --git a/tests/integration/test_aws/data/configuration_template/remove_from_bucket_test_module/configuration_remove_from_bucket.yaml b/tests/integration/test_aws/data/configuration_template/remove_from_bucket_test_module/configuration_remove_from_bucket.yaml new file mode 100644 index 0000000000..5c8d3f24a7 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/remove_from_bucket_test_module/configuration_remove_from_bucket.yaml @@ -0,0 +1,19 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - bucket: + attributes: + - type: BUCKET_TYPE + elements: + - aws_profile: + value: qa + - name: + value: BUCKET_NAME + - remove_from_bucket: + value: 'yes' + - path: + value: PATH diff --git a/tests/integration/test_aws/data/configuration_template/remove_from_bucket_test_module/configuration_remove_log_stream.yaml b/tests/integration/test_aws/data/configuration_template/remove_from_bucket_test_module/configuration_remove_log_stream.yaml new file mode 100644 index 0000000000..2fbdbf0737 --- /dev/null +++ b/tests/integration/test_aws/data/configuration_template/remove_from_bucket_test_module/configuration_remove_log_stream.yaml @@ -0,0 +1,19 @@ +- sections: + - section: wodle + attributes: + - name: aws-s3 + elements: + - disabled: + value: 'no' + - service: + attributes: + - type: SERVICE_TYPE + elements: + - aws_profile: + value: qa + - aws_log_groups: + value: LOG_GROUP_NAME + - remove_log_streams: + value: 'yes' + - regions: + value: us-east-1 diff --git a/tests/integration/test_aws/data/test_cases/basic_test_module/cases_bucket_defaults.yaml b/tests/integration/test_aws/data/test_cases/basic_test_module/cases_bucket_defaults.yaml new file mode 100644 index 0000000000..cedf6c83b2 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/basic_test_module/cases_bucket_defaults.yaml @@ -0,0 +1,125 @@ +- name: cloudtrail_defaults + description: CloudTrail default configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + +- name: vpc_defaults + description: VPC default configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + +- name: config_defaults + description: Config default configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + +- name: alb_defaults + description: ALB default configurations + configuration_parameters: + BUCKET_TYPE: alb + BUCKET_NAME: wazuh-alb-integration-tests + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + +- name: clb_defaults + description: CLB default configurations + configuration_parameters: + BUCKET_TYPE: clb + BUCKET_NAME: wazuh-clb-integration-tests + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + +- name: nlb_defaults + description: NLB default configurations + configuration_parameters: + BUCKET_TYPE: nlb + BUCKET_NAME: wazuh-nlb-integration-tests + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + +- name: kms_defaults + description: KMS default configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-kms-integration-tests + metadata: + bucket_type: custom + bucket_name: wazuh-kms-integration-tests + +- name: macie_defaults + description: CloudTrail default configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-macie-integration-tests + metadata: + bucket_type: custom + bucket_name: wazuh-macie-integration-tests + +- name: trusted_advisor_defaults + description: Trusted Advisor default configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-trusted-advisor-integration-tests + metadata: + bucket_type: custom + bucket_name: wazuh-trusted-advisor-integration-tests + +- name: guardduty_defaults + description: GuardDuty default configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-guardduty-integration-tests + metadata: + bucket_type: guardduty + bucket_name: wazuh-guardduty-integration-tests + +- name: native_guardduty_defaults + description: Native GuardDuty default configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-native-guardduty-integration-tests + metadata: + bucket_type: guardduty + bucket_name: wazuh-native-guardduty-integration-tests + +- name: waf_defaults + description: WAF default configurations + configuration_parameters: + BUCKET_TYPE: waf + BUCKET_NAME: wazuh-waf-integration-tests + metadata: + bucket_type: waf + bucket_name: wazuh-waf-integration-tests + +- name: server_access_defaults + description: Server Access default configurations + configuration_parameters: + BUCKET_TYPE: server_access + BUCKET_NAME: wazuh-server-access-integration-tests + metadata: + bucket_type: server_access + bucket_name: wazuh-server-access-integration-tests + +- name: cisco_umbrella_defaults + description: Umbrella default configurations + configuration_parameters: + BUCKET_TYPE: cisco_umbrella + BUCKET_NAME: wazuh-umbrella-integration-tests + metadata: + bucket_type: cisco_umbrella + bucket_name: wazuh-umbrella-integration-tests diff --git a/tests/integration/test_aws/data/test_cases/basic_test_module/cases_cloudwatch_defaults.yaml b/tests/integration/test_aws/data/test_cases/basic_test_module/cases_cloudwatch_defaults.yaml new file mode 100644 index 0000000000..ca0c2e7ada --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/basic_test_module/cases_cloudwatch_defaults.yaml @@ -0,0 +1,8 @@ +- name: cloudwatchlogs_defaults + description: CloudWatch default configurations + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUP_NAME: wazuh-cloudwatchlogs-integration-tests + metadata: + service_type: cloudwatchlogs + log_group_name: wazuh-cloudwatchlogs-integration-tests diff --git a/tests/integration/test_aws/data/test_cases/basic_test_module/cases_inspector_defaults.yaml b/tests/integration/test_aws/data/test_cases/basic_test_module/cases_inspector_defaults.yaml new file mode 100644 index 0000000000..094da2a539 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/basic_test_module/cases_inspector_defaults.yaml @@ -0,0 +1,6 @@ +- name: inspector_defaults + description: Inspector default configurations + configuration_parameters: + SERVICE_TYPE: inspector + metadata: + service_type: inspector diff --git a/tests/integration/test_aws/data/test_cases/discard_regex_test_module/cases_discard_regex.yaml b/tests/integration/test_aws/data/test_cases/discard_regex_test_module/cases_discard_regex.yaml new file mode 100644 index 0000000000..7c37319fb6 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/discard_regex_test_module/cases_discard_regex.yaml @@ -0,0 +1,238 @@ +- name: cloudtrail_discard_regex + description: CloudTrail discard regex configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + DISCARD_FIELD: eventSource + DISCARD_REGEX: .*ec2.amazonaws.com.* + PATH: '' + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: eventSource + discard_regex: .*ec2.amazonaws.com.* + found_logs: 5 + skipped_logs: 1 + +- name: vpc_discard_regex + description: VPC discard regex configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + DISCARD_FIELD: srcport + DISCARD_REGEX: "5319" + PATH: '' + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: srcport + discard_regex: "5319" + found_logs: 5 + skipped_logs: 1 + +- name: config_discard_regex + description: Config discard regex configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + DISCARD_FIELD: configuration.complianceType + DISCARD_REGEX: .*COMPLIANT.* + PATH: '' + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: configuration.complianceType + discard_regex: .*COMPLIANT.* + found_logs: 5 + skipped_logs: 1 + +- name: alb_discard_regex + description: ALB discard regex configurations + configuration_parameters: + BUCKET_TYPE: alb + BUCKET_NAME: wazuh-alb-integration-tests + DISCARD_FIELD: elb_status_code + DISCARD_REGEX: '401' + PATH: '' + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: elb_status_code + discard_regex: '401' + found_logs: 5 + skipped_logs: 1 + +- name: clb_discard_regex + description: CLB discard regex configurations + configuration_parameters: + BUCKET_TYPE: clb + BUCKET_NAME: wazuh-clb-integration-tests + DISCARD_FIELD: elb_status_code + DISCARD_REGEX: '401' + PATH: '' + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: elb_status_code + discard_regex: '401' + found_logs: 5 + skipped_logs: 1 + +- name: nlb_discard_regex + description: NLB discard regex configurations + configuration_parameters: + BUCKET_TYPE: nlb + BUCKET_NAME: wazuh-nlb-integration-tests + DISCARD_FIELD: listener + DISCARD_REGEX: 0CMK2UAG108C7AXK + PATH: '' + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: listener + discard_regex: 0CMK2UAG108C7AXK + found_logs: 5 + skipped_logs: 1 + +- name: kms_discard_regex + description: KMS discard regex configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-kms-integration-tests + DISCARD_FIELD: eventName + DISCARD_REGEX: MatchDataKey + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-kms-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: eventName + discard_regex: MatchDataKey + found_logs: 3 + skipped_logs: 1 + +- name: macie_discard_regex + description: Macie discard regex configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-macie-integration-tests + DISCARD_FIELD: severity + DISCARD_REGEX: LOW + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-macie-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: severity + discard_regex: LOW + found_logs: 3 + skipped_logs: 1 + +- name: trusted_advisor_discard_regex + description: Trusted Advisor discard regex configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-trusted-advisor-integration-tests + DISCARD_FIELD: status + DISCARD_REGEX: ERROR + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-trusted-advisor-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: status + discard_regex: ERROR + found_logs: 3 + skipped_logs: 1 + +- name: guardduty_discard_regex + description: GuardDuty discard regex configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-guardduty-integration-tests + DISCARD_FIELD: partition + DISCARD_REGEX: aws-test + PATH: '' + metadata: + bucket_type: guardduty + bucket_name: wazuh-guardduty-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: partition + discard_regex: aws-test + found_logs: 3 + skipped_logs: 1 + +- name: native_guardduty_discard_regex + description: Native GuardDuty discard regex configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-native-guardduty-integration-tests + DISCARD_FIELD: partition + DISCARD_REGEX: aws-test + PATH: '' + metadata: + bucket_type: guardduty + bucket_name: wazuh-native-guardduty-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: partition + discard_regex: aws-test + found_logs: 3 + skipped_logs: 1 + +- name: waf_discard_regex + description: WAF discard regex configurations + configuration_parameters: + BUCKET_TYPE: waf + BUCKET_NAME: wazuh-waf-integration-tests + DISCARD_FIELD: action + DISCARD_REGEX: ALLOW + PATH: '' + metadata: + bucket_type: waf + bucket_name: wazuh-waf-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: action + discard_regex: ALLOW + found_logs: 3 + skipped_logs: 1 + +- name: server_access_discard_regex + description: Server Access discard regex configurations + configuration_parameters: + BUCKET_TYPE: server_access + BUCKET_NAME: wazuh-server-access-integration-tests + DISCARD_FIELD: http_status + DISCARD_REGEX: '200' + PATH: '' + metadata: + bucket_type: server_access + bucket_name: wazuh-server-access-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: http_status + discard_regex: '200' + found_logs: 3 + skipped_logs: 1 + +- name: cisco_umbrella_discard_regex + description: CloudTrail discard regex configurations + configuration_parameters: + BUCKET_TYPE: cisco_umbrella + BUCKET_NAME: wazuh-umbrella-integration-tests + DISCARD_FIELD: action + DISCARD_REGEX: Blocked + PATH: dnslogs + metadata: + bucket_type: cisco_umbrella + bucket_name: wazuh-umbrella-integration-tests + only_logs_after: 2022-NOV-20 + discard_field: action + discard_regex: Blocked + found_logs: 3 + skipped_logs: 1 + path: dnslogs diff --git a/tests/integration/test_aws/data/test_cases/log_groups_test_module/cases_log_groups.yaml b/tests/integration/test_aws/data/test_cases/log_groups_test_module/cases_log_groups.yaml new file mode 100644 index 0000000000..aefd5f59f7 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/log_groups_test_module/cases_log_groups.yaml @@ -0,0 +1,21 @@ +- name: cloudwatchlogs_log_groups_with_data + description: CloudWatch log groups configurations + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUP_NAME: wazuh-cloudwatchlogs-integration-tests,temporary-log-group + metadata: + service_type: cloudwatchlogs + log_group_name: wazuh-cloudwatchlogs-integration-tests,temporary-log-group + only_logs_after: 2023-JAN-12 + expected_results: 3 + +- name: cloudwatchlogs_inexistent_log_group + description: CloudWatch log group configurations + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUP_NAME: fake-log-group + metadata: + service_type: cloudwatchlogs + log_group_name: fake-log-group + only_logs_after: 2023-JAN-12 + expected_results: 0 diff --git a/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_multiple_calls.yaml b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_multiple_calls.yaml new file mode 100644 index 0000000000..12b19b6226 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_multiple_calls.yaml @@ -0,0 +1,98 @@ +- name: cloudtrail_only_logs_after_multiple_calls + description: CloudTrail only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + +- name: vpc_only_logs_after_multiple_calls + description: VPC only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + +- name: config_only_logs_after_multiple_calls + description: Config only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + +- name: alb_only_logs_after_multiple_calls + description: ALB only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + +- name: clb_only_logs_after_multiple_calls + description: CLB only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + +- name: nlb_only_logs_after_multiple_calls + description: NLB only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + +- name: kms_only_logs_after_multiple_calls + description: KMS only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: custom + bucket_name: wazuh-kms-integration-tests + +- name: macie_only_logs_after_multiple_calls + description: Macie only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: custom + bucket_name: wazuh-macie-integration-tests + +- name: trusted_advisor_only_logs_after_multiple_calls + description: Trusted Advisor only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: custom + bucket_name: wazuh-trusted-advisor-integration-tests + +- name: guardduty_only_logs_after_multiple_calls + description: GuardDuty only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: guardduty + bucket_name: wazuh-guardduty-integration-tests + +- name: native_guardduty_only_logs_after_multiple_calls + description: Native GuardDuty only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: guardduty + bucket_name: wazuh-native-guardduty-integration-tests + +- name: waf_only_logs_after_multiple_calls + description: WAF only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: waf + bucket_name: wazuh-waf-integration-tests + +- name: server_access_only_logs_after_multiple_calls + description: Server Access only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: server_access + bucket_name: wazuh-server-access-integration-tests + +- name: cisco_umbrella_only_logs_after_multiple_calls + description: Umbrella only_logs_after multiple calls configurations + configuration_parameters: + metadata: + bucket_type: cisco_umbrella + bucket_name: wazuh-umbrella-integration-tests + path: dnslogs diff --git a/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_with_only_logs_after.yaml b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_with_only_logs_after.yaml new file mode 100644 index 0000000000..a466dcbf44 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_with_only_logs_after.yaml @@ -0,0 +1,183 @@ +- name: cloudtrail_with_only_logs_after + description: CloudTrail only logs after configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 5 + +- name: vpc_with_only_logs_after + description: VPC only logs after configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 3 + +- name: config_with_only_logs_after + description: Config only logs after configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 5 + +- name: alb_with_only_logs_after + description: ALB only logs after configurations + configuration_parameters: + BUCKET_TYPE: alb + BUCKET_NAME: wazuh-alb-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 5 + +- name: clb_with_only_logs_after + description: CLB only logs after configurations + configuration_parameters: + BUCKET_TYPE: clb + BUCKET_NAME: wazuh-clb-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 5 + +- name: nlb_with_only_logs_after + description: NLB only logs after configurations + configuration_parameters: + BUCKET_TYPE: nlb + BUCKET_NAME: wazuh-nlb-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 5 + +- name: kms_with_only_logs_after + description: KMS only logs after configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-kms-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-kms-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 3 + +- name: macie_with_only_logs_after + description: Macie only logs after configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-macie-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-macie-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 3 + +- name: trusted_avisor_with_only_logs_after + description: Trusted Advisor only logs after configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-trusted-advisor-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-trusted-advisor-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 3 + +- name: guardduty_with_only_logs_after + description: GuardDuty only logs after configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-guardduty-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: guardduty + bucket_name: wazuh-guardduty-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 3 + +- name: native_guardduty_with_only_logs_after + description: Native GuardDuty only logs after configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-native-guardduty-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: guardduty + bucket_name: wazuh-native-guardduty-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 3 + +- name: waf_with_only_logs_after + description: WAF only logs after configurations + configuration_parameters: + BUCKET_TYPE: waf + BUCKET_NAME: wazuh-waf-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: waf + bucket_name: wazuh-waf-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 3 + +- name: server_access_with_only_logs_after + description: Server Access only logs after configurations + configuration_parameters: + BUCKET_TYPE: server_access + BUCKET_NAME: wazuh-server-access-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: '' + metadata: + bucket_type: server_access + bucket_name: wazuh-server-access-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 3 + table_name: s3_server_access + +- name: cisco_umbrella_with_only_logs_after + description: Umbrella only logs after configurations + configuration_parameters: + BUCKET_TYPE: cisco_umbrella + BUCKET_NAME: wazuh-umbrella-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + PATH: dnslogs + metadata: + bucket_type: cisco_umbrella + bucket_name: wazuh-umbrella-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 3 + path: dnslogs diff --git a/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_without_only_logs_after.yaml b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_without_only_logs_after.yaml new file mode 100644 index 0000000000..8b622f44f8 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_bucket_without_only_logs_after.yaml @@ -0,0 +1,155 @@ +- name: cloudtrail_without_only_logs_after + description: CloudTrail only logs after configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + PATH: '' + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + expected_results: 1 + +- name: vpc_without_only_logs_after + description: VPC only logs after configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + PATH: '' + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + expected_results: 1 + +- name: config_without_only_logs_after + description: Config only logs after configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + PATH: '' + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + expected_results: 1 + +- name: alb_without_only_logs_after + description: ALB only logs after configurations + configuration_parameters: + BUCKET_TYPE: alb + BUCKET_NAME: wazuh-alb-integration-tests + PATH: '' + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + expected_results: 1 + +- name: clb_without_only_logs_after + description: CLB only logs after configurations + configuration_parameters: + BUCKET_TYPE: clb + BUCKET_NAME: wazuh-clb-integration-tests + PATH: '' + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + expected_results: 1 + +- name: nlb_without_only_logs_after + description: NLB only logs after configurations + configuration_parameters: + BUCKET_TYPE: nlb + BUCKET_NAME: wazuh-nlb-integration-tests + PATH: '' + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + expected_results: 1 + +- name: kms_without_only_logs_after + description: KMS only logs after configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-kms-integration-tests + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-kms-integration-tests + expected_results: 1 + +- name: macie_without_only_logs_after + description: Macie only logs after configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-macie-integration-tests + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-macie-integration-tests + expected_results: 1 + +- name: trusted_advisor_without_only_logs_after + description: Trusted Advisor only logs after configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-trusted-advisor-integration-tests + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-trusted-advisor-integration-tests + expected_results: 1 + +- name: guardduty_without_only_logs_after + description: GuardDuty only logs after configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-guardduty-integration-tests + PATH: '' + metadata: + bucket_type: guardduty + bucket_name: wazuh-guardduty-integration-tests + expected_results: 1 + +- name: native_guardduty_without_only_logs_after + description: Native GuardDuty only logs after configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-native-guardduty-integration-tests + PATH: '' + metadata: + bucket_type: guardduty + bucket_name: wazuh-native-guardduty-integration-tests + expected_results: 1 + +- name: waf_without_only_logs_after + description: WAF only logs after configurations + configuration_parameters: + BUCKET_TYPE: waf + BUCKET_NAME: wazuh-waf-integration-tests + PATH: '' + metadata: + bucket_type: waf + bucket_name: wazuh-waf-integration-tests + expected_results: 1 + +- name: server_access_without_only_logs_after + description: Server Access only logs after configurations + configuration_parameters: + BUCKET_TYPE: server_access + BUCKET_NAME: wazuh-server-access-integration-tests + PATH: '' + metadata: + bucket_type: server_access + bucket_name: wazuh-server-access-integration-tests + expected_results: 1 + table_name: s3_server_access + +- name: cisco_umbrella_without_only_logs_after + description: Umbrella only logs after configurations + configuration_parameters: + BUCKET_TYPE: cisco_umbrella + BUCKET_NAME: wazuh-umbrella-integration-tests + PATH: dnslogs + metadata: + bucket_type: cisco_umbrella + bucket_name: wazuh-umbrella-integration-tests + expected_results: 1 + path: dnslogs diff --git a/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_cloudwatch_multiple_calls.yaml b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_cloudwatch_multiple_calls.yaml new file mode 100644 index 0000000000..808e86d511 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_cloudwatch_multiple_calls.yaml @@ -0,0 +1,6 @@ +- name: cloudwatchlogs_only_logs_after_multiple_calls + description: CloudWatch only_logs_after multiple calls configurations + configuration_parameters: + metadata: + service_type: cloudwatchlogs + log_group_name: wazuh-cloudwatchlogs-integration-tests diff --git a/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_cloudwatch_with_only_logs_after.yaml b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_cloudwatch_with_only_logs_after.yaml new file mode 100644 index 0000000000..6fc8afb157 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_cloudwatch_with_only_logs_after.yaml @@ -0,0 +1,12 @@ +- name: cloudwatchlogs_with_only_logs_after + description: CloudWatch only logs after configurations + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUP_NAME: wazuh-cloudwatchlogs-integration-tests + ONLY_LOGS_AFTER: 2022-NOV-20 + metadata: + service_type: cloudwatchlogs + log_group_name: wazuh-cloudwatchlogs-integration-tests + only_logs_after: 2022-NOV-20 + expected_results: 3 + log_stream: permanent-logs diff --git a/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_inspector_multiple_calls.yaml b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_inspector_multiple_calls.yaml new file mode 100644 index 0000000000..738095e861 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_inspector_multiple_calls.yaml @@ -0,0 +1,5 @@ +- name: inspector_only_logs_after_multiple_calls + description: Inspector only_logs_after multiple calls configurations + configuration_parameters: + metadata: + service_type: inspector diff --git a/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_inspector_with_only_logs_after.yaml b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_inspector_with_only_logs_after.yaml new file mode 100644 index 0000000000..860c37e797 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_inspector_with_only_logs_after.yaml @@ -0,0 +1,9 @@ +- name: inspector_with_only_logs_after + description: Inspector only logs after configurations + configuration_parameters: + SERVICE_TYPE: inspector + ONLY_LOGS_AFTER: 2023-JAN-30 + metadata: + service_type: inspector + only_logs_after: 2023-JAN-30 + expected_results: 4 diff --git a/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_service_without_only_logs_after.yaml b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_service_without_only_logs_after.yaml new file mode 100644 index 0000000000..40414b43d6 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/only_logs_after_test_module/cases_service_without_only_logs_after.yaml @@ -0,0 +1,9 @@ +- name: cloudwatchlogs_without_only_logs_after + description: CloudWatch only logs after configurations + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUP_NAME: wazuh-cloudwatchlogs-integration-tests + metadata: + service_type: cloudwatchlogs + log_group_name: wazuh-cloudwatchlogs-integration-tests + expected_results: 1 diff --git a/tests/integration/test_aws/data/test_cases/parser_test_module/cases_bucket_and_service_missing.yaml b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_bucket_and_service_missing.yaml new file mode 100644 index 0000000000..a1b300a75a --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_bucket_and_service_missing.yaml @@ -0,0 +1,4 @@ +- name: parser_bucket_and_service_missing + description: Parser bucket and service missing configurations + configuration_parameters: [] + metadata: [] diff --git a/tests/integration/test_aws/data/test_cases/parser_test_module/cases_empty_values_in_bucket.yaml b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_empty_values_in_bucket.yaml new file mode 100644 index 0000000000..f230042ece --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_empty_values_in_bucket.yaml @@ -0,0 +1,71 @@ +- name: parser_empty_type_in_bucket + description: Parser empty type in bucket + configuration_parameters: + BUCKET_TYPE: '' + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + PATH: test_prefix + PATH_SUFFIX: test_suffix + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_empty_name_in_bucket + description: Parser empty name in bucket + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: '' + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + PATH: test_prefix + PATH_SUFFIX: test_suffix + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_empty_only_logs_after_in_bucket + description: Parser empty only_logs_after in bucket + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: '' + REGIONS: us-east-1 + PATH: test_prefix + PATH_SUFFIX: test_suffix + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_empty_regions_in_bucket + description: Parser empty regions in bucket + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: '' + PATH: test_prefix + PATH_SUFFIX: test_suffix + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_empty_path_in_bucket + description: Parser empty path in bucket + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + PATH: '' + PATH_SUFFIX: test_suffix + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_empty_path_suffix_in_bucket + description: Parser empty path_suffix in bucket + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + PATH: test_prefix + PATH_SUFFIX: '' + REMOVE_FROM_BUCKET: 'no' + metadata: [] diff --git a/tests/integration/test_aws/data/test_cases/parser_test_module/cases_empty_values_in_service.yaml b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_empty_values_in_service.yaml new file mode 100644 index 0000000000..d252f271d0 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_empty_values_in_service.yaml @@ -0,0 +1,39 @@ +- name: parser_empty_type_in_service + description: Parser empty type in service + configuration_parameters: + SERVICE_TYPE: '' + LOG_GROUPS: wazuh-cloudwatch-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_empty_log_groups_in_service + description: Parser empty log_groups in service + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUPS: '' + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_empty_only_logs_after_in_service + description: Parser empty only_logs_after in service + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUPS: wazuh-cloudwatchlogs-integration-tests + ONLY_LOGS_AFTER: '' + REGIONS: us-east-1 + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_empty_regions_in_service + description: Parser empty regions in service + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUPS: wazuh-cloudwatchlogs-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: '' + REMOVE_FROM_BUCKET: 'no' + metadata: [] diff --git a/tests/integration/test_aws/data/test_cases/parser_test_module/cases_invalid_values_in_bucket.yaml b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_invalid_values_in_bucket.yaml new file mode 100644 index 0000000000..9edda13e2a --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_invalid_values_in_bucket.yaml @@ -0,0 +1,83 @@ +- name: parser_invalid_type_in_bucket + description: Parser invalid type in bucket + configuration_parameters: + BUCKET_TYPE: invalid_value + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + PATH: test_prefix + PATH_SUFFIX: test_suffix + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_invalid_name_in_bucket + description: Parser invalid name in bucket + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: 1 + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + PATH: test_prefix + PATH_SUFFIX: test_suffix + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_invalid_only_logs_after_in_bucket + description: Parser invalid only_logs_after in bucket + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: JAN-31 + REGIONS: us-east-1 + PATH: test_prefix + PATH_SUFFIX: test_suffix + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_invalid_regions_in_bucket + description: Parser invalid regions in bucket + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: 1 + PATH: test_prefix + PATH_SUFFIX: test_suffix + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_invalid_path_in_bucket + description: Parser invalid path in bucket + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + PATH: test-prefix> + PATH_SUFFIX: test_suffix + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_invalid_path_suffix_in_bucket + description: Parser invalid path_suffix in bucket + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + PATH: test_prefix + PATH_SUFFIX: test-suffix> + REMOVE_FROM_BUCKET: 'no' + metadata: [] + +- name: parser_invalid_remove_from_bucket_in_bucket + description: Parser invalid remove_from_bucket in bucket + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + PATH: test_prefix + PATH_SUFFIX: test-suffix + REMOVE_FROM_BUCKET: nein + metadata: [] diff --git a/tests/integration/test_aws/data/test_cases/parser_test_module/cases_invalid_values_in_service.yaml b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_invalid_values_in_service.yaml new file mode 100644 index 0000000000..fb739358fc --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_invalid_values_in_service.yaml @@ -0,0 +1,49 @@ +- name: parser_invalid_type_in_service + description: Parser invalid type in service + configuration_parameters: + SERVICE_TYPE: fakeservice + LOG_GROUPS: wazuh-cloudwatch-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + REMOVE_LOG_STREAMS: 'no' + metadata: [] + +- name: parser_invalid_log_groups_in_service + description: Parser invalid log_groups in service + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUPS: invalid_log_group> + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: us-east-1 + REMOVE_LOG_STREAMS: 'no' + metadata: [] + +- name: parser_invalid_only_logs_after_in_service + description: Parser invalid only_logs_after in service + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUPS: wazuh-cloudwatchlogs-integration-tests + ONLY_LOGS_AFTER: JAN-31 + REGIONS: us-east-1 + REMOVE_LOG_STREAMS: 'no' + metadata: [] + +- name: parser_invalid_regions_in_service + description: Parser invalid regions in service + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUPS: wazuh-cloudwatchlogs-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: 1 + REMOVE_LOG_STREAMS: 'no' + metadata: [] + +- name: parser_invalid_remove_log_stream_in_service + description: Parser invalid remove_log_stream in service + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUPS: wazuh-cloudwatchlogs-integration-tests + ONLY_LOGS_AFTER: 2023-JAN-31 + REGIONS: 1 + REMOVE_LOG_STREAMS: nein + metadata: [] diff --git a/tests/integration/test_aws/data/test_cases/parser_test_module/cases_multiple_bucket_and_service_tags.yaml b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_multiple_bucket_and_service_tags.yaml new file mode 100644 index 0000000000..6b07c332e6 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_multiple_bucket_and_service_tags.yaml @@ -0,0 +1,4 @@ +- name: parser_mutiple_bucket_and_service_tags + description: Parser multiple bucket and service tags configurations + configuration_parameters: [] + metadata: [] diff --git a/tests/integration/test_aws/data/test_cases/parser_test_module/cases_type_missing_in_bucket.yaml b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_type_missing_in_bucket.yaml new file mode 100644 index 0000000000..44cef7e1dd --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_type_missing_in_bucket.yaml @@ -0,0 +1,4 @@ +- name: parser_type_missing_in_bucket + description: Parser type missing in bucket configurations + configuration_parameters: [] + metadata: [] diff --git a/tests/integration/test_aws/data/test_cases/parser_test_module/cases_type_missing_in_service.yaml b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_type_missing_in_service.yaml new file mode 100644 index 0000000000..d8ba3d2b20 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/parser_test_module/cases_type_missing_in_service.yaml @@ -0,0 +1,4 @@ +- name: parser_type_missing_in_service + description: Parser type missing in service configurations + configuration_parameters: [] + metadata: [] diff --git a/tests/integration/test_aws/data/test_cases/path_suffix_test_module/cases_path_suffix.yaml b/tests/integration/test_aws/data/test_cases/path_suffix_test_module/cases_path_suffix.yaml new file mode 100644 index 0000000000..b95f1695a6 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/path_suffix_test_module/cases_path_suffix.yaml @@ -0,0 +1,116 @@ +- name: cloudtrail_path_suffix_with_data + description: CloudTrail path_suffix configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + PATH_SUFFIX: test_suffix + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + only_logs_after: 2022-NOV-20 + path_suffix: test_suffix + expected_results: 1 + +- name: cloudtrail_path_suffix_without_data + description: CloudTrail path_suffix configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + PATH_SUFFIX: empty_suffix + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + only_logs_after: 2022-NOV-20 + path_suffix: empty_suffix + expected_results: 0 + +- name: cloudtrail_inexistent_path_suffix + description: CloudTrail path_suffix configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + PATH_SUFFIX: inexistent_suffix + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + only_logs_after: 2022-NOV-20 + path_suffix: inexistent_suffix + expected_results: 0 + +- name: vpc_path_suffix_with_data + description: VPC path_suffix configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + PATH_SUFFIX: test_suffix + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + only_logs_after: 2022-NOV-20 + path_suffix: test_suffix + expected_results: 1 + +- name: config_path_suffix_with_data + description: Config path_suffix configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + PATH_SUFFIX: test_suffix + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + only_logs_after: 2022-NOV-20 + path_suffix: test_suffix + expected_results: 1 + +- name: vpc_path_suffix_without_data + description: VPC path_suffix configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + PATH_SUFFIX: empty_suffix + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + only_logs_after: 2022-NOV-20 + path_suffix: empty_suffix + expected_results: 0 + +- name: config_path_suffix_without_data + description: Config path_suffix configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + PATH_SUFFIX: empty_suffix + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + only_logs_after: 2022-NOV-20 + path_suffix: empty_suffix + expected_results: 0 + +- name: vpc_inexistent_path_suffix + description: VPC path_suffix configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + PATH_SUFFIX: inexistent_suffix + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + only_logs_after: 2022-NOV-20 + path_suffix: inexistent_suffix + expected_results: 0 + +- name: config_inexistent_path_suffix + description: Config path_suffix configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + PATH_SUFFIX: inexistent_suffix + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + only_logs_after: 2022-NOV-20 + path_suffix: inexistent_suffix + expected_results: 0 diff --git a/tests/integration/test_aws/data/test_cases/path_test_module/cases_path.yaml b/tests/integration/test_aws/data/test_cases/path_test_module/cases_path.yaml new file mode 100644 index 0000000000..86b04ea2aa --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/path_test_module/cases_path.yaml @@ -0,0 +1,548 @@ +- name: cloudtrail_path_with_data + description: CloudTrail path configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + PATH: test_prefix + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: cloudtrail_path_without_data + description: CloudTrail path configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + PATH: empty_prefix + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: cloudtrail_inexistent_path + description: CloudTrail path configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: vpc_path_with_data + description: VPC path configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + PATH: test_prefix + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: vpc_path_without_data + description: VPC path configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + PATH: empty_prefix + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: cisco_umbrella_path_with_data + description: Umbrella path configurations + configuration_parameters: + BUCKET_TYPE: cisco_umbrella + BUCKET_NAME: wazuh-umbrella-integration-tests + PATH: test_prefix/dnslogs + metadata: + bucket_type: cisco_umbrella + bucket_name: wazuh-umbrella-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix/dnslogs + expected_results: 1 + +- name: cisco_umbrella_path_without_data + description: Umbrella path configurations + configuration_parameters: + BUCKET_TYPE: cisco_umbrella + BUCKET_NAME: wazuh-umbrella-integration-tests + PATH: empty_prefix + metadata: + bucket_type: cisco_umbrella + bucket_name: wazuh-umbrella-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: vpc_inexistent_path + description: CloudTrail path configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: config_path_with_data + description: Config path configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + PATH: test_prefix + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: config_path_without_data + description: Config path configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + PATH: empty_prefix + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: config_inexistent_path + description: Config path configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: alb_path_with_data + description: ALB path configurations + configuration_parameters: + BUCKET_TYPE: alb + BUCKET_NAME: wazuh-alb-integration-tests + PATH: test_prefix + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: alb_path_without_data + description: ALB path configurations + configuration_parameters: + BUCKET_TYPE: alb + BUCKET_NAME: wazuh-alb-integration-tests + PATH: empty_prefix + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: alb_inexistent_path + description: ALB path configurations + configuration_parameters: + BUCKET_TYPE: alb + BUCKET_NAME: wazuh-alb-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: clb_path_with_data + description: CLB path configurations + configuration_parameters: + BUCKET_TYPE: clb + BUCKET_NAME: wazuh-clb-integration-tests + PATH: test_prefix + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: clb_path_without_data + description: CLB path configurations + configuration_parameters: + BUCKET_TYPE: clb + BUCKET_NAME: wazuh-clb-integration-tests + PATH: empty_prefix + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: clb_inexistent_path + description: CLB path configurations + configuration_parameters: + BUCKET_TYPE: clb + BUCKET_NAME: wazuh-clb-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: nlb_path_with_data + description: NLB path configurations + configuration_parameters: + BUCKET_TYPE: nlb + BUCKET_NAME: wazuh-nlb-integration-tests + PATH: test_prefix + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: nlb_path_without_data + description: NLB path configurations + configuration_parameters: + BUCKET_TYPE: nlb + BUCKET_NAME: wazuh-nlb-integration-tests + PATH: empty_prefix + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: nlb_inexistent_path + description: NLB path configurations + configuration_parameters: + BUCKET_TYPE: nlb + BUCKET_NAME: wazuh-nlb-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: kms_path_with_data + description: KMS path configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-kms-integration-tests + PATH: test_prefix + metadata: + bucket_type: custom + bucket_name: wazuh-kms-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: kms_path_without_data + description: KMS path configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-kms-integration-tests + PATH: empty_prefix + metadata: + bucket_type: custom + bucket_name: wazuh-kms-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: kms_inexistent_path + description: KMS path configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-kms-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: custom + bucket_name: wazuh-kms-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: macie_path_with_data + description: Macie path configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-macie-integration-tests + PATH: test_prefix + metadata: + bucket_type: custom + bucket_name: wazuh-macie-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: macie_path_without_data + description: Macie path configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-macie-integration-tests + PATH: empty_prefix + metadata: + bucket_type: custom + bucket_name: wazuh-macie-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: macie_inexistent_path + description: Macie path configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-macie-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: custom + bucket_name: wazuh-macie-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: trusted_advisor_path_with_data + description: Trusted Advisor path configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-trusted-advisor-integration-tests + PATH: test_prefix + metadata: + bucket_type: custom + bucket_name: wazuh-trusted-advisor-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: trusted_advisor_path_without_data + description: Trusted Advisor path configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-trusted-advisor-integration-tests + PATH: empty_prefix + metadata: + bucket_type: custom + bucket_name: wazuh-trusted-advisor-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: trusted_advisor_inexistent_path + description: Trusted Advisor path configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-trusted-advisor-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: custom + bucket_name: wazuh-trusted-advisor-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: guardduty_path_with_data + description: GuardDuty path configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-guardduty-integration-tests + PATH: test_prefix + metadata: + bucket_type: guardduty + bucket_name: wazuh-guardduty-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: guardduty_path_without_data + description: GuardDuty path configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-guardduty-integration-tests + PATH: empty_prefix + metadata: + bucket_type: guardduty + bucket_name: wazuh-guardduty-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: guardduty_inexistent_path + description: GuardDuty path configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-guardduty-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: guardduty + bucket_name: wazuh-guardduty-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: native_guardduty_path_with_data + description: Native GuardDuty path configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-native-guardduty-integration-tests + PATH: test_prefix + metadata: + bucket_type: guardduty + bucket_name: wazuh-native-guardduty-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: native_guardduty_path_without_data + description: Native GuardDuty path configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-native-guardduty-integration-tests + PATH: empty_prefix + metadata: + bucket_type: guardduty + bucket_name: wazuh-native-guardduty-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: native_guardduty_inexistent_path + description: Native GuardDuty path configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-native-guardduty-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: guardduty + bucket_name: wazuh-native-guardduty-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: waf_path_with_data + description: WAF path configurations + configuration_parameters: + BUCKET_TYPE: waf + BUCKET_NAME: wazuh-waf-integration-tests + PATH: test_prefix + metadata: + bucket_type: waf + bucket_name: wazuh-waf-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + +- name: waf_path_without_data + description: WAF path configurations + configuration_parameters: + BUCKET_TYPE: waf + BUCKET_NAME: wazuh-waf-integration-tests + PATH: empty_prefix + metadata: + bucket_type: waf + bucket_name: wazuh-waf-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + +- name: waf_inexistent_path + description: WAF path configurations + configuration_parameters: + BUCKET_TYPE: waf + BUCKET_NAME: wazuh-waf-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: waf + bucket_name: wazuh-waf-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + +- name: server_access_path_with_data + description: Server Access path configurations + configuration_parameters: + BUCKET_TYPE: server_access + BUCKET_NAME: wazuh-server-access-integration-tests + PATH: test_prefix + metadata: + bucket_type: server_access + bucket_name: wazuh-server-access-integration-tests + only_logs_after: 2022-NOV-20 + path: test_prefix + expected_results: 1 + table_name: s3_server_access + +- name: server_access_path_without_data + description: Server Access path configurations + configuration_parameters: + BUCKET_TYPE: server_access + BUCKET_NAME: wazuh-server-access-integration-tests + PATH: empty_prefix + metadata: + bucket_type: server_access + bucket_name: wazuh-server-access-integration-tests + only_logs_after: 2022-NOV-20 + path: empty_prefix + expected_results: 0 + table_name: s3_server_access + +- name: server_access_inexistent_path + description: Server Access path configurations + configuration_parameters: + BUCKET_TYPE: server_access + BUCKET_NAME: wazuh-server-access-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: server_access + bucket_name: wazuh-server-access-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 + table_name: s3_server_access + +- name: cisco_umbrella_inexistent_path + description: Umbrella path configurations + configuration_parameters: + BUCKET_TYPE: cisco_umbrella + BUCKET_NAME: wazuh-umbrella-integration-tests + PATH: inexistent_prefix + metadata: + bucket_type: cisco_umbrella + bucket_name: wazuh-umbrella-integration-tests + only_logs_after: 2022-NOV-20 + path: inexistent_prefix + expected_results: 0 diff --git a/tests/integration/test_aws/data/test_cases/regions_test_module/cases_bucket_regions.yaml b/tests/integration/test_aws/data/test_cases/regions_test_module/cases_bucket_regions.yaml new file mode 100644 index 0000000000..07231f255a --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/regions_test_module/cases_bucket_regions.yaml @@ -0,0 +1,233 @@ +- name: cloudtrail_region_with_data + description: CloudTrail regions configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + REGIONS: us-east-1 + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1 + expected_results: 3 + +- name: cloudtrail_regions_with_data + description: CloudTrail regions configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + REGIONS: us-east-1,us-east-2 + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1,us-east-2 + expected_results: 5 + +- name: cloudtrail_inexistent_region + description: CloudTrail regions configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + REGIONS: us-fake-1 + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-fake-1 + expected_results: 0 + +- name: vpc_region_with_data + description: VPC regions configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + REGIONS: us-east-1 + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1 + expected_results: 3 + +- name: config_region_with_data + description: Config regions configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + REGIONS: us-east-1 + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1 + expected_results: 3 + +- name: alb_region_with_data + description: ALB regions configurations + configuration_parameters: + BUCKET_TYPE: alb + BUCKET_NAME: wazuh-alb-integration-tests + REGIONS: us-east-1 + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1 + expected_results: 3 + +- name: vpc_regions_with_data + description: VPC regions configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + REGIONS: us-east-1,us-east-2 + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1,us-east-2 + expected_results: 5 + +- name: config_regions_with_data + description: Config regions configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + REGIONS: us-east-1,us-east-2 + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1,us-east-2 + expected_results: 5 + +- name: alb_regions_with_data + description: ALB regions configurations + configuration_parameters: + BUCKET_TYPE: alb + BUCKET_NAME: wazuh-alb-integration-tests + REGIONS: us-east-1,us-east-2 + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1,us-east-2 + expected_results: 5 + +- name: vpc_inexistent_region + description: VPC regions configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + REGIONS: us-fake-1 + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-fake-1 + expected_results: 0 + +- name: config_inexistent_region + description: Config regions configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + REGIONS: us-fake-1 + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-fake-1 + expected_results: 0 + +- name: alb_inexistent_region + description: ALB regions configurations + configuration_parameters: + BUCKET_TYPE: alb + BUCKET_NAME: wazuh-alb-integration-tests + REGIONS: us-fake-1 + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-fake-1 + expected_results: 0 + +- name: clb_region_with_data + description: CLB regions configurations + configuration_parameters: + BUCKET_TYPE: clb + BUCKET_NAME: wazuh-clb-integration-tests + REGIONS: us-east-1 + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1 + expected_results: 3 + +- name: clb_regions_with_data + description: CLB regions configurations + configuration_parameters: + BUCKET_TYPE: clb + BUCKET_NAME: wazuh-clb-integration-tests + REGIONS: us-east-1,us-east-2 + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1,us-east-2 + expected_results: 5 + +- name: clb_inexistent_region + description: CLB regions configurations + configuration_parameters: + BUCKET_TYPE: clb + BUCKET_NAME: wazuh-clb-integration-tests + REGIONS: us-fake-1 + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-fake-1 + expected_results: 0 + +- name: nlb_region_with_data + description: NLB regions configurations + configuration_parameters: + BUCKET_TYPE: nlb + BUCKET_NAME: wazuh-nlb-integration-tests + REGIONS: us-east-1 + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1 + expected_results: 3 + +- name: nlb_regions_with_data + description: NLB regions configurations + configuration_parameters: + BUCKET_TYPE: nlb + BUCKET_NAME: wazuh-nlb-integration-tests + REGIONS: us-east-1,us-east-2 + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-east-1,us-east-2 + expected_results: 5 + +- name: nlb_inexistent_region + description: NLB regions configurations + configuration_parameters: + BUCKET_TYPE: nlb + BUCKET_NAME: wazuh-nlb-integration-tests + REGIONS: us-fake-1 + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + only_logs_after: 2022-NOV-20 + regions: us-fake-1 + expected_results: 0 diff --git a/tests/integration/test_aws/data/test_cases/regions_test_module/cases_cloudwatch_regions.yaml b/tests/integration/test_aws/data/test_cases/regions_test_module/cases_cloudwatch_regions.yaml new file mode 100644 index 0000000000..d5f4c3b8e4 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/regions_test_module/cases_cloudwatch_regions.yaml @@ -0,0 +1,38 @@ +- name: cloudwatchlogs_region_with_data + description: CloudWatch regions configurations + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUP_NAME: wazuh-cloudwatchlogs-integration-tests + REGIONS: us-east-1 + metadata: + service_type: cloudwatchlogs + log_group_name: wazuh-cloudwatchlogs-integration-tests + only_logs_after: 2023-JAN-12 + regions: us-east-1 + expected_results: 3 + +- name: cloudwatchlogs_regions_with_data + description: CloudWatch regions configurations + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUP_NAME: wazuh-cloudwatchlogs-integration-tests + REGIONS: us-east-1,us-east-2 + metadata: + service_type: cloudwatchlogs + log_group_name: wazuh-cloudwatchlogs-integration-tests + only_logs_after: 2023-JAN-12 + regions: us-east-1,us-east-2 + expected_results: 3 + +- name: cloudwatchlogs_inexistent_region + description: CloudWatch regions configurations + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUP_NAME: wazuh-cloudwatchlogs-integration-tests + REGIONS: us-fake-1 + metadata: + service_type: cloudwatchlogs + log_group_name: wazuh-cloudwatchlogs-integration-tests + only_logs_after: 2023-JAN-12 + regions: us-fake-1 + expected_results: 0 diff --git a/tests/integration/test_aws/data/test_cases/regions_test_module/cases_inspector_regions.yaml b/tests/integration/test_aws/data/test_cases/regions_test_module/cases_inspector_regions.yaml new file mode 100644 index 0000000000..fc1fbbd39b --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/regions_test_module/cases_inspector_regions.yaml @@ -0,0 +1,32 @@ +- name: inspector_region_with_data + description: Inspector regions configurations + configuration_parameters: + SERVICE_TYPE: inspector + REGIONS: us-east-1 + metadata: + service_type: inspector + only_logs_after: 2023-JAN-12 + regions: us-east-1 + expected_results: 4 + +- name: inspector_regions_with_data + description: Inspector regions configurations + configuration_parameters: + SERVICE_TYPE: inspector + REGIONS: us-east-1,us-east-2 + metadata: + service_type: inspector + only_logs_after: 2023-JAN-12 + regions: us-east-1,us-east-2 + expected_results: 4 + +- name: inspector_inexistent_region + description: Inspector regions configurations + configuration_parameters: + SERVICE_TYPE: inspector + REGIONS: us-fake-1 + metadata: + service_type: inspector + only_logs_after: 2023-JAN-12 + regions: us-fake-1 + expected_results: 0 diff --git a/tests/integration/test_aws/data/test_cases/remove_from_bucket_test_module/cases_remove_from_bucket.yaml b/tests/integration/test_aws/data/test_cases/remove_from_bucket_test_module/cases_remove_from_bucket.yaml new file mode 100644 index 0000000000..eb26143283 --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/remove_from_bucket_test_module/cases_remove_from_bucket.yaml @@ -0,0 +1,140 @@ +- name: cloudtrail_remove_from_bucket + description: CloudTrail remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: cloudtrail + BUCKET_NAME: wazuh-cloudtrail-integration-tests + PATH: '' + metadata: + bucket_type: cloudtrail + bucket_name: wazuh-cloudtrail-integration-tests + +- name: vpc_remove_from_bucket + description: VPC remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: vpcflow + BUCKET_NAME: wazuh-vpcflow-integration-tests + PATH: '' + metadata: + bucket_type: vpcflow + bucket_name: wazuh-vpcflow-integration-tests + +- name: config_remove_from_bucket + description: Config remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: config + BUCKET_NAME: wazuh-config-integration-tests + PATH: '' + metadata: + bucket_type: config + bucket_name: wazuh-config-integration-tests + +- name: alb_remove_from_bucket + description: ALB remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: alb + BUCKET_NAME: wazuh-alb-integration-tests + PATH: '' + metadata: + bucket_type: alb + bucket_name: wazuh-alb-integration-tests + +- name: clb_remove_from_bucket + description: CLB remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: clb + BUCKET_NAME: wazuh-clb-integration-tests + PATH: '' + metadata: + bucket_type: clb + bucket_name: wazuh-clb-integration-tests + +- name: nlb_remove_from_bucket + description: NLB remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: nlb + BUCKET_NAME: wazuh-nlb-integration-tests + PATH: '' + metadata: + bucket_type: nlb + bucket_name: wazuh-nlb-integration-tests + +- name: kms_remove_from_bucket + description: KMS remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-kms-integration-tests + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-kms-integration-tests + +- name: macie_remove_from_bucket + description: Macie remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-macie-integration-tests + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-macie-integration-tests + +- name: trusted_advisor_remove_from_bucket + description: Trusted Advisor remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: custom + BUCKET_NAME: wazuh-trusted-advisor-integration-tests + PATH: '' + metadata: + bucket_type: custom + bucket_name: wazuh-trusted-advisor-integration-tests + +- name: guardduty_remove_from_bucket + description: GuardDuty remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-guardduty-integration-tests + PATH: '' + metadata: + bucket_type: guardduty + bucket_name: wazuh-guardduty-integration-tests + +- name: native_guardduty_remove_from_bucket + description: Native GuardDuty remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: guardduty + BUCKET_NAME: wazuh-native-guardduty-integration-tests + PATH: '' + metadata: + bucket_type: guardduty + bucket_name: wazuh-native-guardduty-integration-tests + +- name: waf_remove_from_bucket + description: WAF remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: waf + BUCKET_NAME: wazuh-waf-integration-tests + PATH: '' + metadata: + bucket_type: waf + bucket_name: wazuh-waf-integration-tests + +- name: server_access_remove_from_bucket + description: Server Access remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: server_access + BUCKET_NAME: wazuh-server-access-integration-tests + PATH: '' + metadata: + bucket_type: server_access + bucket_name: wazuh-server-access-integration-tests + +- name: cisco_umbrella_remove_from_bucket + description: CloudTrail remove from bucket configurations + configuration_parameters: + BUCKET_TYPE: cisco_umbrella + BUCKET_NAME: wazuh-umbrella-integration-tests + PATH: dnslogs + metadata: + bucket_type: cisco_umbrella + bucket_name: wazuh-umbrella-integration-tests + path: dnslogs diff --git a/tests/integration/test_aws/data/test_cases/remove_from_bucket_test_module/cases_remove_log_streams.yaml b/tests/integration/test_aws/data/test_cases/remove_from_bucket_test_module/cases_remove_log_streams.yaml new file mode 100644 index 0000000000..dfc941327c --- /dev/null +++ b/tests/integration/test_aws/data/test_cases/remove_from_bucket_test_module/cases_remove_log_streams.yaml @@ -0,0 +1,8 @@ +- name: cloudwatchlogs_remove_from_bucket + description: CloudWatch remove from bucket configurations + configuration_parameters: + SERVICE_TYPE: cloudwatchlogs + LOG_GROUP_NAME: temporary-log-group + metadata: + service_type: cloudwatchlogs + log_group_name: temporary-log-group diff --git a/tests/integration/test_aws/test_basic.py b/tests/integration/test_aws/test_basic.py new file mode 100644 index 0000000000..0fd305f997 --- /dev/null +++ b/tests/integration/test_aws/test_basic.py @@ -0,0 +1,315 @@ +import os + +import pytest +from wazuh_testing import TEMPLATE_DIR, TEST_CASES_DIR, global_parameters +from wazuh_testing.modules.aws import event_monitor, local_internal_options # noqa: F401 +from wazuh_testing.tools.configuration import ( + get_test_cases_data, + load_configuration_template, +) + +pytestmark = [pytest.mark.server] + + +# Generic vars +MODULE = 'basic_test_module' +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, TEMPLATE_DIR, MODULE) +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, TEST_CASES_DIR, MODULE) + +# -------------------------------------------- TEST_BUCKET_DEFAULTS ---------------------------------------------------- +# Configuration and cases data +t1_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'bucket_configuration_defaults.yaml') +t1_cases_path = os.path.join(TEST_CASES_PATH, 'cases_bucket_defaults.yaml') + +# Enabled test configurations +t1_configuration_parameters, t1_configuration_metadata, t1_case_ids = get_test_cases_data(t1_cases_path) +t1_configurations = load_configuration_template( + t1_configurations_path, t1_configuration_parameters, t1_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t1_configurations, t1_configuration_metadata), ids=t1_case_ids) +def test_bucket_defaults( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_s3_cloudtrail_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: The module is invoked with the expected parameters and no error occurs. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - Check in the ossec.log that no errors occurs. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check in the log that no errors occurs. + input_description: + - The `configuration_defaults` file provides the module configuration for this test. + - The `cases_defaults` file provides the test cases. + """ + parameters = [ + 'wodles/aws/aws-s3', + '--bucket', metadata['bucket_name'], + '--aws_profile', 'qa', + '--type', metadata['bucket_type'], + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + # Detect any ERROR message + with pytest.raises(TimeoutError): + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_all_aws_err, + ).result() + + +# -------------------------------------------- TEST_CLOUDWATCH_DEFAULTS ------------------------------------------------ +# Configuration and cases data +t2_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'cloudwatch_configuration_defaults.yaml') +t2_cases_path = os.path.join(TEST_CASES_PATH, 'cases_cloudwatch_defaults.yaml') + +# Enabled test configurations +t2_configuration_parameters, t2_configuration_metadata, t2_case_ids = get_test_cases_data(t2_cases_path) +configurations = load_configuration_template( + t2_configurations_path, t2_configuration_parameters, t2_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(configurations, t2_configuration_metadata), ids=t2_case_ids) +def test_service_defaults( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_aws_services_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: The module is invoked with the expected parameters and no error occurs. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - Check in the ossec.log that no errors occurs. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_aws_services_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check in the log that no errors occurs. + input_description: + - The `configuration_defaults` file provides the module configuration for this test. + - The `cases_defaults` file provides the test cases. + """ + log_groups = metadata.get('log_group_name') + + parameters = [ + 'wodles/aws/aws-s3', + '--service', metadata['service_type'], + '--aws_profile', 'qa', + '--regions', 'us-east-1', + '--aws_log_groups', log_groups, + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + # Detect any ERROR message + with pytest.raises(TimeoutError): + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_all_aws_err, + ).result() + + +# ------------------------------------------ TEST_INSPECTOR_DEFAULTS --------------------------------------------------- +# Configuration and cases data +t3_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'inspector_configuration_defaults.yaml') +t3_cases_path = os.path.join(TEST_CASES_PATH, 'cases_inspector_defaults.yaml') + +# Enabled test configurations +t3_configuration_parameters, t3_configuration_metadata, t3_case_ids = get_test_cases_data(t3_cases_path) +configurations = load_configuration_template( + t3_configurations_path, t3_configuration_parameters, t3_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(configurations, t3_configuration_metadata), ids=t3_case_ids) +def test_inspector_defaults( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_aws_services_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: The module is invoked with the expected parameters and no error occurs. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - Check in the ossec.log that no errors occurs. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_aws_services_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check in the log that no errors occurs. + input_description: + - The `configuration_defaults` file provides the module configuration for this test. + - The `cases_defaults` file provides the test cases. + """ + + parameters = [ + 'wodles/aws/aws-s3', + '--service', metadata['service_type'], + '--aws_profile', 'qa', + '--regions', 'us-east-1', + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + # Detect any ERROR message + with pytest.raises(TimeoutError): + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_all_aws_err, + ).result() diff --git a/tests/integration/test_aws/test_discard_regex.py b/tests/integration/test_aws/test_discard_regex.py new file mode 100644 index 0000000000..0b41bb37c2 --- /dev/null +++ b/tests/integration/test_aws/test_discard_regex.py @@ -0,0 +1,142 @@ +import os + +import pytest +from wazuh_testing import T_20, TEMPLATE_DIR, TEST_CASES_DIR, global_parameters +from wazuh_testing.modules.aws import event_monitor, local_internal_options # noqa: F401 +from wazuh_testing.modules.aws.db_utils import s3_db_exists +from wazuh_testing.tools.configuration import ( + get_test_cases_data, + load_configuration_template, +) + +pytestmark = [pytest.mark.server] + + +# Generic vars +MODULE = 'discard_regex_test_module' +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, TEMPLATE_DIR, MODULE) +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, TEST_CASES_DIR, MODULE) + +# ---------------------------------------------------- TEST_PATH ------------------------------------------------------- +configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_discard_regex.yaml') +cases_path = os.path.join(TEST_CASES_PATH, 'cases_discard_regex.yaml') + +configuration_parameters, configuration_metadata, case_ids = get_test_cases_data(cases_path) +configurations = load_configuration_template( + configurations_path, configuration_parameters, configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=case_ids) +def test_discard_regex( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_s3_cloudtrail_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring, +): + """ + description: Fetch logs excluding the ones that match with the regex. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - Check the expected number of events were forwarded to analysisd, only logs stored in the bucket and skips + the ones that match with regex. + - Check the database was created and updated accordingly. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_s3_cloudtrail_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check the expected number of events were forwarded to analysisd. + - Check the database was created and updated accordingly. + input_description: + - The `configuration_discard_regex` file provides the module configuration for this test. + - The `cases_discard_regex` file provides the test cases. + """ + bucket_name = metadata['bucket_name'] + bucket_type = metadata['bucket_type'] + only_logs_after = metadata['only_logs_after'] + discard_field = metadata['discard_field'] + discard_regex = metadata['discard_regex'] + found_logs = metadata['found_logs'] + skipped_logs = metadata['skipped_logs'] + path = metadata['path'] if 'path' in metadata else None + + pattern = fr'.*The "{discard_regex}" regex found a match in the "{discard_field}" field. The event will be skipped.' + + parameters = [ + 'wodles/aws/aws-s3', + '--bucket', bucket_name, + '--aws_profile', 'qa', + '--only_logs_after', only_logs_after, + '--discard-field', discard_field, + '--discard-regex', discard_regex, + '--type', bucket_type, + '--debug', '2' + ] + + if path is not None: + parameters.insert(5, path) + parameters.insert(5, '--trail_prefix') + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + log_monitor.start( + timeout=T_20, + callback=event_monitor.callback_detect_event_processed_or_skipped(pattern), + error_message=( + 'The AWS module did not show the correct message about discard regex or ', + 'did not process the expected amount of logs' + ), + accum_results=found_logs + skipped_logs + ).result() + + assert s3_db_exists() diff --git a/tests/integration/test_aws/test_log_groups.py b/tests/integration/test_aws/test_log_groups.py new file mode 100644 index 0000000000..fc3a84680a --- /dev/null +++ b/tests/integration/test_aws/test_log_groups.py @@ -0,0 +1,157 @@ +import os + +import pytest +from wazuh_testing import T_10, T_20, TEMPLATE_DIR, TEST_CASES_DIR, global_parameters +from wazuh_testing.modules.aws import event_monitor, local_internal_options # noqa: F401 +from wazuh_testing.modules.aws.db_utils import ( + get_multiple_service_db_row, + services_db_exists, + table_exists, +) +from wazuh_testing.tools.configuration import ( + get_test_cases_data, + load_configuration_template, +) + +pytestmark = [pytest.mark.server] + + +# Generic vars +MODULE = 'log_groups_test_module' +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, TEMPLATE_DIR, MODULE) +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, TEST_CASES_DIR, MODULE) + +# ----------------------------------------------- TEST_AWS_LOG_GROUPS -------------------------------------------------- +t1_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_log_groups.yaml') +t1_cases_path = os.path.join(TEST_CASES_PATH, 'cases_log_groups.yaml') + +t1_configuration_parameters, t1_configuration_metadata, t1_case_ids = get_test_cases_data(t1_cases_path) +t1_configurations = load_configuration_template( + t1_configurations_path, t1_configuration_parameters, t1_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t1_configurations, t1_configuration_metadata), ids=t1_case_ids) +def test_log_groups( + configuration, metadata, create_log_stream, load_wazuh_basic_configuration, set_wazuh_configuration, + clean_aws_services_db, configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, + file_monitoring +): + """ + description: Only the events for the specified log_group are processed. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - If a region that does not exist was specified, make sure that a message is displayed in the ossec.log + warning the user. + - Check the expected number of events were forwarded to analysisd, only logs stored in the bucket + for the specified region. + - Check the database was created and updated accordingly. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - create_log_stream: + type: fixture + brief: Create a log stream with events for the day of execution. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_aws_services_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check the expected number of events were forwarded to analysisd. + - Check the database was created and updated accordingly, using the correct path for each entry. + input_description: + - The `configuration_regions` file provides the module configuration for this test. + - The `cases_regions` file provides the test cases. + """ + service_type = metadata['service_type'] + log_group_names = metadata['log_group_name'] + expected_results = metadata['expected_results'] + + parameters = [ + 'wodles/aws/aws-s3', + '--service', service_type, + '--aws_profile', 'qa', + '--only_logs_after', '2023-JAN-12', + '--regions', 'us-east-1', + '--aws_log_groups', log_group_names, + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + if expected_results: + log_monitor.start( + timeout=T_20, + callback=event_monitor.callback_detect_service_event_processed(expected_results, service_type), + error_message='The AWS module did not process the expected number of events', + accum_results=len(log_group_names.split(',')) + ).result() + else: + with pytest.raises(TimeoutError): + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.make_aws_callback(r'DEBUG: \+\+\+ Sent \d+ events to Analysisd'), + ).result() + + log_monitor.start( + timeout=T_10, + callback=event_monitor.make_aws_callback(r'.*The specified log group does not exist.'), + error_message='The AWS module did not show correct message non-existent log group' + ).result() + + assert services_db_exists() + + if expected_results: + log_group_list = log_group_names.split(",") + for row in get_multiple_service_db_row(table_name='cloudwatch_logs'): + assert row.aws_log_group in log_group_list + else: + assert not table_exists(table_name='cloudwatch_logs') diff --git a/tests/integration/test_aws/test_only_logs_after.py b/tests/integration/test_aws/test_only_logs_after.py new file mode 100644 index 0000000000..50d67e894f --- /dev/null +++ b/tests/integration/test_aws/test_only_logs_after.py @@ -0,0 +1,918 @@ +import os +from datetime import datetime + +import pytest +from wazuh_testing import T_10, T_20, TEMPLATE_DIR, TEST_CASES_DIR, global_parameters +from wazuh_testing.modules import aws as cons +from wazuh_testing.modules.aws import ONLY_LOGS_AFTER_PARAM, event_monitor, local_internal_options # noqa: F401 +from wazuh_testing.modules.aws.cli_utils import call_aws_module +from wazuh_testing.modules.aws.cloudwatch_utils import ( + create_log_events, + create_log_stream, +) +from wazuh_testing.modules.aws.db_utils import ( + get_multiple_s3_db_row, + get_s3_db_row, + get_service_db_row, + s3_db_exists, + services_db_exists, +) +from wazuh_testing.modules.aws.s3_utils import get_last_file_key, upload_file +from wazuh_testing.tools.configuration import ( + get_test_cases_data, + load_configuration_template, +) + +pytestmark = [pytest.mark.server] + + +# Generic vars +MODULE = 'only_logs_after_test_module' +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, TEMPLATE_DIR, MODULE) +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, TEST_CASES_DIR, MODULE) + +# --------------------------------------------- TEST_BUCKET_WITHOUT_ONLY_LOGS_AFTER ------------------------------------ +t1_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'bucket_configuration_without_only_logs_after.yaml') +t1_cases_path = os.path.join(TEST_CASES_PATH, 'cases_bucket_without_only_logs_after.yaml') + +t1_configuration_parameters, t1_configuration_metadata, t1_case_ids = get_test_cases_data(t1_cases_path) +t1_configurations = load_configuration_template( + t1_configurations_path, t1_configuration_parameters, t1_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t1_configurations, t1_configuration_metadata), ids=t1_case_ids) +def test_bucket_without_only_logs_after( + configuration, metadata, upload_and_delete_file_to_s3, load_wazuh_basic_configuration, set_wazuh_configuration, + clean_s3_cloudtrail_db, configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, + file_monitoring +): + """ + description: Only the log uploaded during execution is processed. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - Check the expected number of events were sent to analysisd. Only the logs whose timestamp is greater than + the date specified in the configuration should be processed. + - Check the database was created and updated accordingly. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - upload_and_delete_file_to_s3: + type: fixture + brief: Upload a file for the day of the execution and delete after the test. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_s3_cloudtrail_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check in the bucket that the uploaded log was removed. + input_description: + - The `configuration_defaults` file provides the module configuration for this test. + - The `cases_defaults` file provides the test cases. + """ + bucket_name = metadata['bucket_name'] + bucket_type = metadata['bucket_type'] + expected_results = metadata['expected_results'] + table_name = metadata.get('table_name', bucket_type) + path = metadata.get('path') + + parameters = [ + 'wodles/aws/aws-s3', + '--bucket', bucket_name, + '--aws_profile', 'qa', + '--type', bucket_type, + '--debug', '2' + ] + + if path is not None: + parameters.insert(5, path) + parameters.insert(5, '--trail_prefix') + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_event_processed, + error_message='The AWS module did not process the expected number of events', + accum_results=expected_results + ).result() + + assert s3_db_exists() + + data = get_s3_db_row(table_name=table_name) + + assert bucket_name in data.bucket_path + assert metadata['uploaded_file'] == data.log_key + + +# -------------------------------------------- TEST_SERVICE_WITHOUT_ONLY_LOGS_AFTER ------------------------------------ +t2_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'service_configuration_without_only_logs_after.yaml') +t2_cases_path = os.path.join(TEST_CASES_PATH, 'cases_service_without_only_logs_after.yaml') + +t2_configuration_parameters, t2_configuration_metadata, t2_case_ids = get_test_cases_data(t2_cases_path) +t2_configurations = load_configuration_template( + t2_configurations_path, t2_configuration_parameters, t2_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t2_configurations, t2_configuration_metadata), ids=t2_case_ids) +def test_service_without_only_logs_after( + configuration, metadata, create_log_stream_in_existent_group, load_wazuh_basic_configuration, + set_wazuh_configuration, clean_aws_services_db, configure_local_internal_options_function, truncate_monitored_files, + restart_wazuh_function, file_monitoring +): + """ + description: Only the event created during execution is processed. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - Check the expected number of events were sent to analysisd. Only the logs whose timestamp is greater than + the date specified in the configuration should be processed. + - Check the database was created and updated accordingly. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - create_log_stream_in_existent_group: + type: fixture + brief: Create a log stream with events for the day of execution. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_aws_services_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check in the bucket that the uploaded log was removed. + input_description: + - The `configuration_defaults` file provides the module configuration for this test. + - The `cases_defaults` file provides the test cases. + """ + service_type = metadata['service_type'] + log_group_name = metadata['log_group_name'] + expected_results = metadata['expected_results'] + + parameters = [ + 'wodles/aws/aws-s3', + '--service', service_type, + '--aws_profile', 'qa', + '--regions', 'us-east-1', + '--aws_log_groups', log_group_name, + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + log_monitor.start( + timeout=T_10, + callback=event_monitor.callback_detect_service_event_processed(expected_results, service_type), + error_message='The AWS module did not process the expected number of events', + ).result() + + assert services_db_exists() + + data = get_service_db_row(table_name="cloudwatch_logs") + + assert log_group_name == data.aws_log_group + assert metadata['log_stream'] == data.aws_log_stream + + +# --------------------------------------------- TEST_BUCKET_WITH_ONLY_LOGS_AFTER --------------------------------------- +t3_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'bucket_configuration_with_only_logs_after.yaml') +t3_cases_path = os.path.join(TEST_CASES_PATH, 'cases_bucket_with_only_logs_after.yaml') + +t3_configuration_parameters, t3_configuration_metadata, t3_case_ids = get_test_cases_data(t3_cases_path) +t3_configurations = load_configuration_template( + t3_configurations_path, t3_configuration_parameters, t3_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t3_configurations, t3_configuration_metadata), ids=t3_case_ids) +def test_bucket_with_only_logs_after( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_s3_cloudtrail_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: All logs with a timestamp greater than the only_logs_after value are processed. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - Check the expected number of events were sent to analysisd. Only the logs whose timestamp is greater than + the date specified in the configuration should be processed. + - Check the database was created and updated accordingly + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_s3_cloudtrail_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check in the bucket that the uploaded log was removed. + input_description: + - The `configuration_defaults` file provides the module configuration for this test. + - The `cases_defaults` file provides the test cases. + """ + bucket_name = metadata['bucket_name'] + bucket_type = metadata['bucket_type'] + only_logs_after = metadata['only_logs_after'] + expected_results = metadata['expected_results'] + table_name = metadata.get('table_name', bucket_type) + path = metadata.get('path') + + parameters = [ + 'wodles/aws/aws-s3', + '--bucket', bucket_name, + '--aws_profile', 'qa', + '--only_logs_after', only_logs_after, + '--type', bucket_type, + '--debug', '2' + ] + + if path is not None: + parameters.insert(5, path) + parameters.insert(5, '--trail_prefix') + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + log_monitor.start( + timeout=T_20, + callback=event_monitor.callback_detect_event_processed, + accum_results=expected_results, + error_message='The AWS module did not process the expected number of events', + ).result() + + assert s3_db_exists() + + for row in get_multiple_s3_db_row(table_name=table_name): + assert bucket_name in row.bucket_path + assert ( + datetime.strptime(only_logs_after, '%Y-%b-%d') < datetime.strptime(str(row.created_date), '%Y%m%d') + ) + + +# --------------------------------------------TEST_CLOUDWATCH_WITH_ONLY_LOGS_AFTER ------------------------------------- +t4_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'cloudwatch_configuration_with_only_logs_after.yaml') +t4_cases_path = os.path.join(TEST_CASES_PATH, 'cases_cloudwatch_with_only_logs_after.yaml') + +t4_configuration_parameters, t4_configuration_metadata, t4_case_ids = get_test_cases_data(t4_cases_path) +t4_configurations = load_configuration_template( + t4_configurations_path, t4_configuration_parameters, t4_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t4_configurations, t4_configuration_metadata), ids=t4_case_ids) +def test_cloudwatch_with_only_logs_after( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_aws_services_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: All events with a timestamp greater than the only_logs_after value are processed. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - Check the expected number of events were sent to analysisd. Only the logs whose timestamp is greater than + the date specified in the configuration should be processed. + - Check the database was created and updated accordingly. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_aws_services_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check in the bucket that the uploaded log was removed. + input_description: + - The `configuration_defaults` file provides the module configuration for this test. + - The `cases_defaults` file provides the test cases. + """ + table_name_map = { + 'inspector': 'aws_services', + 'cloudwatchlogs': 'cloudwatch_logs' + } + + service_type = metadata['service_type'] + log_group_name = metadata.get('log_group_name') + only_logs_after = metadata['only_logs_after'] + expected_results = metadata['expected_results'] + + parameters = [ + 'wodles/aws/aws-s3', + '--service', service_type, + '--aws_profile', 'qa', + '--only_logs_after', only_logs_after, + '--regions', 'us-east-1', + '--aws_log_groups', log_group_name, + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + log_monitor.start( + timeout=T_10, + callback=event_monitor.callback_detect_service_event_processed(expected_results, service_type), + error_message='The AWS module did not process the expected number of events', + ).result() + + assert services_db_exists() + + data = get_service_db_row(table_name=table_name_map[service_type]) + + assert log_group_name == data.aws_log_group + assert metadata['log_stream'] == data.aws_log_stream + + +# ------------------------------------------ TEST_INSPECTOR_WITH_ONLY_LOGS_AFTER --------------------------------------- +t5_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'inspector_configuration_with_only_logs_after.yaml') +t5_cases_path = os.path.join(TEST_CASES_PATH, 'cases_inspector_with_only_logs_after.yaml') + +t5_configuration_parameters, t5_configuration_metadata, t5_case_ids = get_test_cases_data(t5_cases_path) +t5_configurations = load_configuration_template( + t5_configurations_path, t5_configuration_parameters, t5_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t5_configurations, t5_configuration_metadata), ids=t5_case_ids) +def test_inspector_with_only_logs_after( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_aws_services_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: All events with a timestamp greater than the only_logs_after value are processed. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - Check the expected number of events were sent to analysisd. Only the logs whose timestamp is greater than + the date specified in the configuration should be processed. + - Check the database was created and updated accordingly. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_aws_services_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check in the bucket that the uploaded log was removed. + input_description: + - The `configuration_defaults` file provides the module configuration for this test. + - The `cases_defaults` file provides the test cases. + """ + table_name_map = { + 'inspector': 'aws_services', + 'cloudwatchlogs': 'cloudwatch_logs' + } + + service_type = metadata['service_type'] + only_logs_after = metadata['only_logs_after'] + expected_results = metadata['expected_results'] + + parameters = [ + 'wodles/aws/aws-s3', + '--service', service_type, + '--aws_profile', 'qa', + '--only_logs_after', only_logs_after, + '--regions', 'us-east-1', + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + log_monitor.start( + timeout=T_10, + callback=event_monitor.callback_detect_service_event_processed(expected_results, service_type), + error_message='The AWS module did not process the expected number of events', + ).result() + + assert services_db_exists() + + data = get_service_db_row(table_name=table_name_map[service_type]) + + assert data.service == service_type + assert ( + datetime.strptime(data.timestamp, '%Y-%m-%d %H:%M:%S.%f') == datetime.strptime(only_logs_after, '%Y-%b-%d') + ) + + +# ---------------------------------------------------- TEST_MULTIPLE_CALLS --------------------------------------------- +t5_cases_path = os.path.join(TEST_CASES_PATH, 'cases_bucket_multiple_calls.yaml') + +_, t5_configuration_metadata, t5_case_ids = get_test_cases_data(t5_cases_path) + + +@pytest.mark.tier(level=1) +@pytest.mark.parametrize('metadata', t5_configuration_metadata, ids=t5_case_ids) +def test_bucket_multiple_calls( + metadata, clean_s3_cloudtrail_db, load_wazuh_basic_configuration, restart_wazuh_function, delete_file_from_s3 +): + """ + description: Call the AWS module multiple times with different only_logs_after values. + test_phases: + - setup: + - Delete the `s3_cloudtrail.db`. + + - test: + - Call the module without only_logs_after and check that no logs were processed. + - Upload a log file for the day of the test execution and call the module with the same parameters as + before, check that the uploaded logs were processed. + - Call the module with the same parameters and check that no logs were processed, there were no duplicates. + - Call the module with only_logs_after set in the past and check that the expected number of logs were + processed. + - Call the module with the same parameters in and check there were no duplicates. + - Call the module with only_logs_after set with an older date check that old logs were processed without + duplicates. + - Call the module with only_logs_after set with an early date than setted previously and check that no logs + were processed, there were no duplicates. + + - teardown: + - Delete the `s3_cloudtrail.db`. + - Delete the uploaded files. + wazuh_min_version: 4.5.0 + parameters: + - metadata: + type: dict + brief: Get metadata from the module. + - clean_s3_cloudtrail_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - restart_wazuh_daemon: + type: fixture + brief: Restart the wazuh service. + - delete_file_from_s3: + type: fixture + brief: Delete the a file after the test execution. + input_description: + - The `cases_multiple_calls` file provides the test cases. + """ + + bucket_type = metadata['bucket_type'] + bucket_name = metadata['bucket_name'] + path = metadata.get('path') + + base_parameters = [ + '--bucket', bucket_name, + '--type', bucket_type, + '--regions', 'us-east-1', + '--aws_profile', 'qa', + '--debug', '2' + ] + + if path is not None: + base_parameters.extend(['--trail_prefix', path]) + + # Call the module without only_logs_after and check that no logs were processed + last_marker_key = datetime.utcnow().strftime(cons.PATH_DATE_FORMAT) + + event_monitor.check_non_processed_logs_from_output( + command_output=call_aws_module(*base_parameters), + bucket_type=bucket_type + ) + + # Call the module with only_logs_after set in the past and check that the expected number of logs were + # processed + event_monitor.check_processed_logs_from_output( + command_output=call_aws_module(*base_parameters, ONLY_LOGS_AFTER_PARAM, '2022-NOV-20'), + expected_results=3 + ) + + # Call the module with the same parameters in and check there were no duplicates + expected_skipped_logs_step_3 = metadata.get('expected_skipped_logs_step_3', 1) + event_monitor.check_non_processed_logs_from_output( + command_output=call_aws_module(*base_parameters, ONLY_LOGS_AFTER_PARAM, '2022-NOV-20'), + bucket_type=bucket_type, + expected_results=expected_skipped_logs_step_3 + ) + + # Call the module with only_logs_after set with an early date than setted previously and check that no logs + # were processed, there were no duplicates + event_monitor.check_non_processed_logs_from_output( + command_output=call_aws_module(*base_parameters, ONLY_LOGS_AFTER_PARAM, '2022-NOV-22'), + bucket_type=bucket_type, + expected_results=expected_skipped_logs_step_3 - 1 if expected_skipped_logs_step_3 > 1 else 1 + ) + + # Upload a log file for the day of the test execution and call the module without only_logs_after and check that + # only the uploaded logs were processed and the last marker is specified in the DB. + last_marker_key = get_last_file_key(bucket_type, bucket_name, datetime.utcnow()) + metadata['filename'] = upload_file(bucket_type, bucket_name) + + event_monitor.check_marker_from_output( + command_output=call_aws_module(*base_parameters), + file_key=last_marker_key + ) + + +# -------------------------------------------- TEST_INSPECTOR_MULTIPLE_CALLS ------------------------------------------- +t6_cases_path = os.path.join(TEST_CASES_PATH, 'cases_inspector_multiple_calls.yaml') + +_, t6_configuration_metadata, t6_case_ids = get_test_cases_data(t6_cases_path) + + +@pytest.mark.tier(level=1) +@pytest.mark.parametrize('metadata', t6_configuration_metadata, ids=t6_case_ids) +@pytest.mark.xfail +def test_inspector_multiple_calls( + metadata, clean_aws_services_db, load_wazuh_basic_configuration, restart_wazuh_function +): + """ + description: Call the AWS module multiple times with different only_logs_after values. + test_phases: + - setup: + - Delete the `aws_services.db`. + - test: + - Call the module without only_logs_after and check that no logs were processed. + - Call the module with only_logs_after set in the past and check that the expected number of logs were + processed. + - Call the module with the same parameters in and check there were no duplicates. + - Call the module with only_logs_after set with an early date than setted previously and check that no logs + were processed, there were no duplicates. + - teardown: + - Delete the `aws_services.db`. + wazuh_min_version: 4.5.0 + parameters: + - metadata: + type: dict + brief: Get metadata from the module. + - clean_aws_services_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - restart_wazuh_daemon: + type: fixture + brief: Restart the wazuh service. + input_description: + - The `cases_multiple_calls` file provides the test cases. + """ + + service_type = metadata['service_type'] + + base_parameters = [ + '--service', service_type, + '--regions', 'us-east-1', + '--aws_profile', 'qa', + '--debug', '2' + ] + + # Call the module without only_logs_after and check that no logs were processed + event_monitor.check_service_non_processed_logs_from_output( + command_output=call_aws_module(*base_parameters), service_type=service_type, expected_results=1 + ) + + # Call the module with only_logs_after set in the past and check that the expected number of logs were + # processed + event_monitor.check_service_processed_logs_from_output( + command_output=call_aws_module(*base_parameters, ONLY_LOGS_AFTER_PARAM, '2023-JAN-30'), + service_type=service_type, + events_sent=4 + ) + + # Call the module with the same parameters in and check there were no duplicates + event_monitor.check_service_non_processed_logs_from_output( + command_output=call_aws_module(*base_parameters, ONLY_LOGS_AFTER_PARAM, '2023-JAN-30'), + service_type=service_type, + expected_results=1 + ) + + # Call the module with only_logs_after set with an early date than setted previously and check that no logs + # were processed, there were no duplicates + event_monitor.check_service_non_processed_logs_from_output( + command_output=call_aws_module(*base_parameters, ONLY_LOGS_AFTER_PARAM, '2023-JAN-31'), + service_type=service_type, + expected_results=1 + ) + + +# ----------------------------------------- TEST_CLOUDWATCH_MULTIPLE_CALLS --------------------------------------------- +t7_cases_path = os.path.join(TEST_CASES_PATH, 'cases_cloudwatch_multiple_calls.yaml') + +_, t7_configuration_metadata, t7_case_ids = get_test_cases_data(t7_cases_path) + + +@pytest.mark.tier(level=1) +@pytest.mark.parametrize('metadata', t7_configuration_metadata, ids=t7_case_ids) +def test_cloudwatch_multiple_calls( + metadata, clean_aws_services_db, load_wazuh_basic_configuration, restart_wazuh_function, delete_log_stream +): + """ + description: Call the AWS module multiple times with different only_logs_after values. + test_phases: + - setup: + - Delete the `aws_services.db`. + - test: + - Call the module without only_logs_after and check that no logs were processed. + - Upload a log file for the day of the test execution and call the module with the same parameters as + before, check that the uploaded logs were processed. + - Call the module with the same parameters and check that no logs were processed, there were no duplicates. + - Call the module with only_logs_after set in the past and check that the expected number of logs were + processed. + - Call the module with the same parameters in and check there were no duplicates. + - Call the module with only_logs_after set with an older date check that old logs were processed without + duplicates. + - Call the module with only_logs_after set with an early date than setted previously and check that no logs + were processed, there were no duplicates. + - teardown: + - Delete the `aws_services.db`. + - Delete the uploaded files. + wazuh_min_version: 4.5.0 + parameters: + - metadata: + type: dict + brief: Get metadata from the module. + - clean_aws_services_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - restart_wazuh_daemon: + type: fixture + brief: Restart the wazuh service. + - delete_log_stream: + type: fixture + brief: Delete the log stream after the test execution. + input_description: + - The `cases_multiple_calls` file provides the test cases. + """ + + service_type = metadata['service_type'] + log_group_name = metadata['log_group_name'] + + base_parameters = [ + '--service', service_type, + '--aws_log_groups', log_group_name, + '--regions', 'us-east-1', + '--aws_profile', 'qa', + '--debug', '2' + ] + + # Call the module without only_logs_after and check that no logs were processed + event_monitor.check_service_non_processed_logs_from_output( + command_output=call_aws_module(*base_parameters), service_type=service_type, expected_results=0 + ) + + # Call the module with only_logs_after set in the past and check that the expected number of logs were + # processed + event_monitor.check_service_processed_logs_from_output( + command_output=call_aws_module(*base_parameters, ONLY_LOGS_AFTER_PARAM, '2023-JAN-12'), + service_type=service_type, + events_sent=3 + ) + + # Call the module with the same parameters in and check there were no duplicates + event_monitor.check_service_non_processed_logs_from_output( + command_output=call_aws_module(*base_parameters, ONLY_LOGS_AFTER_PARAM, '2023-JAN-12'), + service_type=service_type, + expected_results=0 + ) + + # Call the module with only_logs_after set with an early date than setted previously and check that no logs + # were processed, there were no duplicates + event_monitor.check_service_non_processed_logs_from_output( + command_output=call_aws_module(*base_parameters, ONLY_LOGS_AFTER_PARAM, '2023-JAN-15'), + service_type=service_type, + expected_results=0 + ) + + # Upload a log file for the day of the test execution and call the module without only_logs_after and check that + # only the uploaded logs were processed. + log_stream = create_log_stream() + metadata['log_stream'] = log_stream + create_log_events(log_stream) + event_monitor.check_service_processed_logs_from_output( + command_output=call_aws_module(*base_parameters), service_type=service_type, events_sent=1 + ) diff --git a/tests/integration/test_aws/test_parser.py b/tests/integration/test_aws/test_parser.py new file mode 100644 index 0000000000..25011f87c9 --- /dev/null +++ b/tests/integration/test_aws/test_parser.py @@ -0,0 +1,597 @@ +import os + +import pytest +from wazuh_testing import T_20, TEMPLATE_DIR, TEST_CASES_DIR, global_parameters +from wazuh_testing.modules.aws import event_monitor, local_internal_options # noqa: F401 +from wazuh_testing.tools.configuration import ( + get_test_cases_data, + load_configuration_template, +) + +pytestmark = [pytest.mark.server] + + +# Generic vars +MODULE = 'parser_test_module' +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, TEMPLATE_DIR, MODULE) +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, TEST_CASES_DIR, MODULE) + +# --------------------------------------------TEST_BUCKET_AND_SERVICE_MISSING ------------------------------------------ +# Configuration and cases data +t1_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_bucket_and_service_missing.yaml') +t1_cases_path = os.path.join(TEST_CASES_PATH, 'cases_bucket_and_service_missing.yaml') + +# Enabled test configurations +t1_configuration_parameters, t1_configuration_metadata, t1_case_ids = get_test_cases_data(t1_cases_path) +t1_configurations = load_configuration_template( + t1_configurations_path, t1_configuration_parameters, t1_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t1_configurations, t1_configuration_metadata), ids=t1_case_ids) +def test_bucket_and_service_missing( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function_without_exception, + file_monitoring +): + """ + description: Command for bucket and service weren't invoked. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has not appeared calling the module with correct parameters. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_function_without_exception: + type: fixture + brief: Restart the wazuh service catching the exception. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was not called. + + input_description: + - The `configuration_bucket_and_service_missing` file provides the configuration for this test. + """ + + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_warning, + error_message='The AWS module did not show the expected warning', + ).result() + + # Check AWS module not started + with pytest.raises(TimeoutError): + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_started, + ).result() + + +# -------------------------------------------- TEST_TYPE_MISSING_IN_BUCKET --------------------------------------------- +# Configuration and cases data +t2_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_type_missing_in_bucket.yaml') +t2_cases_path = os.path.join(TEST_CASES_PATH, 'cases_type_missing_in_bucket.yaml') + +# Enabled test configurations +t2_configuration_parameters, t2_configuration_metadata, t2_case_ids = get_test_cases_data(t2_cases_path) +t2_configurations = load_configuration_template( + t2_configurations_path, t2_configuration_parameters, t2_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t2_configurations, t2_configuration_metadata), ids=t2_case_ids) +def test_type_missing_in_bucket( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function_without_exception, + file_monitoring +): + """ + description: A warning occurs and was displayed in `ossec.log`. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has not appeared calling the module with correct parameters. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_function_without_exception: + type: fixture + brief: Restart the wazuh service catching the exception. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module displays the message about missing attributes. + input_description: + - The `configuration_type_missing_in_bucket` file provides the configuration for this test. + """ + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_legacy_module_warning, + error_message='The AWS module did not show the expected legacy warning', + ).result() + + +# -------------------------------------------- TEST_TYPE_MISSING_IN_SERVICE -------------------------------------------- +# Configuration and cases data +t3_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_type_missing_in_service.yaml') +t3_cases_path = os.path.join(TEST_CASES_PATH, 'cases_type_missing_in_service.yaml') + +# Enabled test configurations +t3_configuration_parameters, t3_configuration_metadata, t3_case_ids = get_test_cases_data(t3_cases_path) +t3_configurations = load_configuration_template( + t3_configurations_path, t3_configuration_parameters, t3_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t3_configurations, t3_configuration_metadata), ids=t3_case_ids) +def test_type_missing_in_service( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function_without_exception, + file_monitoring +): + """ + description: An error occurs and was displayed in `ossec.log`. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has not appeared calling the module with correct parameters. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_function_without_exception: + type: fixture + brief: Restart the wazuh service catching the exception. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module displays the message about missing attributes. + + input_description: + - The `configuration_type_missing_in_service` file provides the configuration for this test. + """ + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_error_for_missing_type, + error_message='The AWS module did not show the expected error message', + ).result() + + +# -------------------------------------------- TEST_EMPTY_VALUES_IN_BUCKET --------------------------------------------- +# Configuration and cases data +t4_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_values_in_bucket.yaml') +t4_cases_path = os.path.join(TEST_CASES_PATH, 'cases_empty_values_in_bucket.yaml') + +# Enabled test configurations +t4_configuration_parameters, t4_configuration_metadata, t4_case_ids = get_test_cases_data(t4_cases_path) +t4_configurations = load_configuration_template( + t4_configurations_path, t4_configuration_parameters, t4_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t4_configurations, t4_configuration_metadata), ids=t4_case_ids) +def test_empty_values_in_bucket( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function_without_exception, + file_monitoring +): + """ + description: An error occurs and was displayed in `ossec.log`. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has not appeared calling the module with correct parameters. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_function_without_exception: + type: fixture + brief: Restart the wazuh service catching the exception. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module displays the message about an empty value. + input_description: + - The `configuration_values_in_bucket` file provides the configuration for this test. + """ + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_empty_value, + error_message='The AWS module did not show the expected message about empty value', + ).result() + + +# -------------------------------------------- TEST_EMPTY_VALUES_IN_SERVICE -------------------------------------------- +# Configuration and cases data +t5_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_values_in_service.yaml') +t5_cases_path = os.path.join(TEST_CASES_PATH, 'cases_empty_values_in_service.yaml') + +# Enabled test configurations +t5_configuration_parameters, t5_configuration_metadata, t5_case_ids = get_test_cases_data(t5_cases_path) +t5_configurations = load_configuration_template( + t5_configurations_path, t5_configuration_parameters, t5_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t5_configurations, t5_configuration_metadata), ids=t5_case_ids) +def test_empty_values_in_service( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function_without_exception, + file_monitoring +): + """ + description: An error occurs and was displayed in `ossec.log`. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has not appeared calling the module with correct parameters. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_function_without_exception: + type: fixture + brief: Restart the wazuh service catching the exception. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module displays the message about an empty value. + + input_description: + - The `configuration_values_in_service` file provides the configuration for this test. + """ + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_empty_value, + error_message='The AWS module did not show the expected message about empty value', + ).result() + + +# ------------------------------------------ TEST_INVALID_VALUES_IN_BUCKET --------------------------------------------- +# Configuration and cases data +t6_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_values_in_bucket.yaml') +t6_cases_path = os.path.join(TEST_CASES_PATH, 'cases_invalid_values_in_bucket.yaml') + +# Enabled test configurations +t6_configuration_parameters, t6_configuration_metadata, t6_case_ids = get_test_cases_data(t6_cases_path) +t6_configurations = load_configuration_template( + t6_configurations_path, t6_configuration_parameters, t6_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t6_configurations, t6_configuration_metadata), ids=t6_case_ids) +def test_invalid_values_in_bucket( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function_without_exception, + file_monitoring +): + """ + description: An error occurs and was displayed in `ossec.log`. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has not appeared calling the module with correct parameters. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_function_without_exception: + type: fixture + brief: Restart the wazuh service catching the exception. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module displays the message about an invalid value. + input_description: + - The `configuration_values_in_bucket` file provides the configuration for this test. + """ + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_invalid_value, + error_message='The AWS module did not show the expected message about invalid value', + ).result() + + +# ------------------------------------------ TEST_INVALID_VALUES_IN_BUCKET --------------------------------------------- +# Configuration and cases data +t7_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_values_in_service.yaml') +t7_cases_path = os.path.join(TEST_CASES_PATH, 'cases_invalid_values_in_service.yaml') + +# Enabled test configurations +t7_configuration_parameters, t7_configuration_metadata, t7_case_ids = get_test_cases_data(t7_cases_path) +t7_configurations = load_configuration_template( + t7_configurations_path, t7_configuration_parameters, t7_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t7_configurations, t7_configuration_metadata), ids=t7_case_ids) +def test_invalid_values_in_service( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function_without_exception, + file_monitoring +): + """ + description: An error occurs and was displayed in `ossec.log`. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has not appeared calling the module with correct parameters. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_function_without_exception: + type: fixture + brief: Restart the wazuh service catching the exception. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module displays the message about an invalid value. + input_description: + - The `configuration_values_in_service` file provides the configuration for this test. + """ + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_invalid_value, + error_message='The AWS module did not show the expected message about invalid value', + ).result() + + +# --------------------------------------- TEST_MULTIPLE_BUCKET_AND_SERVICE_TAGS ---------------------------------------- +# Configuration and cases data +t8_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_multiple_bucket_and_service_tags.yaml') +t8_cases_path = os.path.join(TEST_CASES_PATH, 'cases_multiple_bucket_and_service_tags.yaml') + +# Enabled test configurations +t8_configuration_parameters, t8_configuration_metadata, t8_case_ids = get_test_cases_data(t8_cases_path) +t8_configurations = load_configuration_template( + t8_configurations_path, t8_configuration_parameters, t8_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t8_configurations, t8_configuration_metadata), ids=t8_case_ids) +def test_multiple_bucket_and_service_tags( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function_without_exception, + file_monitoring +): + """ + description: The command is invoked two times for buckets and two times for services. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has not appeared calling the module with correct parameters. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_function_without_exception: + type: fixture + brief: Restart the wazuh service catching the exception. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called the right amount of times. + input_description: + - The `configuration_multiple_bucket_and_service_tags` file provides the configuration for this test. + """ + log_monitor.start( + timeout=T_20, + callback=event_monitor.callback_detect_bucket_or_service_call, + error_message='The AWS module was not called for bucket or service the right amount of times', + accum_results=4 + ).result() diff --git a/tests/integration/test_aws/test_path.py b/tests/integration/test_aws/test_path.py new file mode 100644 index 0000000000..6d377217ed --- /dev/null +++ b/tests/integration/test_aws/test_path.py @@ -0,0 +1,155 @@ +import os + +import pytest +from wazuh_testing import T_10, T_20, TEMPLATE_DIR, TEST_CASES_DIR, global_parameters +from wazuh_testing.modules.aws import event_monitor, local_internal_options # noqa: F401 +from wazuh_testing.modules.aws.db_utils import ( + get_s3_db_row, + s3_db_exists, + table_exists_or_has_values, +) +from wazuh_testing.tools.configuration import ( + get_test_cases_data, + load_configuration_template, +) + +pytestmark = [pytest.mark.server] + + +# Generic vars +MODULE = 'path_test_module' +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, TEMPLATE_DIR, MODULE) +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, TEST_CASES_DIR, MODULE) + +# ---------------------------------------------------- TEST_PATH ------------------------------------------------------- +configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_path.yaml') +cases_path = os.path.join(TEST_CASES_PATH, 'cases_path.yaml') + +configuration_parameters, configuration_metadata, case_ids = get_test_cases_data(cases_path) +configurations = load_configuration_template( + configurations_path, configuration_parameters, configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=case_ids) +def test_path( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_s3_cloudtrail_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: Only logs within a path are processed. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - If a path that does not exist was specified, make sure that a message is displayed in the ossec.log + warning the user. + - Check the command was called with the correct parameters. + - Check the database was created and updated accordingly. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_s3_cloudtrail_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check the expected number of events were forwarded to analysisd. + - Check the database was created and updated accordingly, using the correct path for each entry. + input_description: + - The `configuration_path` file provides the module configuration for this test. + - The `cases_path` file provides the test cases. + """ + bucket_name = metadata['bucket_name'] + bucket_type = metadata['bucket_type'] + only_logs_after = metadata['only_logs_after'] + path = metadata['path'] + expected_results = metadata['expected_results'] + table_name = metadata.get('table_name', bucket_type) + pattern = fr".*WARNING: Bucket: - No files were found in '{bucket_name}/{path}/'. No logs will be processed.\n+" + + parameters = [ + 'wodles/aws/aws-s3', + '--bucket', bucket_name, + '--aws_profile', 'qa', + '--trail_prefix', path, + '--only_logs_after', only_logs_after, + '--type', bucket_type, + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + if expected_results: + log_monitor.start( + timeout=T_20, + callback=event_monitor.callback_detect_event_processed, + error_message='The AWS module did not process the expected number of events', + ).result() + else: + with pytest.raises(TimeoutError): + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_event_processed, + ).result() + + log_monitor.start( + timeout=T_10, + callback=event_monitor.make_aws_callback(pattern), + error_message='The AWS module did not show correct message about empty path' + ).result() + + assert s3_db_exists() + + if expected_results: + data = get_s3_db_row(table_name=table_name) + assert f"{bucket_name}/{path}/" == data.bucket_path + assert data.log_key.startswith(f"{path}/") + else: + assert not table_exists_or_has_values(table_name=table_name) diff --git a/tests/integration/test_aws/test_path_suffix.py b/tests/integration/test_aws/test_path_suffix.py new file mode 100644 index 0000000000..f9597edb34 --- /dev/null +++ b/tests/integration/test_aws/test_path_suffix.py @@ -0,0 +1,157 @@ +import os + +import pytest +from wazuh_testing import T_10, T_20, TEMPLATE_DIR, TEST_CASES_DIR, global_parameters +from wazuh_testing.modules.aws import event_monitor, local_internal_options # noqa: F401 +from wazuh_testing.modules.aws.db_utils import ( + get_s3_db_row, + s3_db_exists, + table_exists_or_has_values, +) +from wazuh_testing.tools.configuration import ( + get_test_cases_data, + load_configuration_template, +) + +pytestmark = [pytest.mark.server] + + +# Generic vars +MODULE = 'path_suffix_test_module' +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, TEMPLATE_DIR, MODULE) +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, TEST_CASES_DIR, MODULE) + +# ---------------------------------------------------- TEST_PATH ------------------------------------------------------- +configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_path_suffix.yaml') +cases_path = os.path.join(TEST_CASES_PATH, 'cases_path_suffix.yaml') + +configuration_parameters, configuration_metadata, case_ids = get_test_cases_data(cases_path) +configurations = load_configuration_template( + configurations_path, configuration_parameters, configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=case_ids) +def test_path_suffix( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_s3_cloudtrail_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: Only logs within a path_suffix are processed. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - If a path_suffix that does not exist was specified, make sure that a message is displayed in the ossec.log + warning the user. + - Check the command was called with the correct parameters. + - Check the database was created and updated accordingly. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_s3_cloudtrail_db: + type: fixture + brief: Delete the DB file before and after the test execution + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check the expected number of events were forwarded to analysisd. + - Check the database was created and updated accordingly, using the correct path for each entry. + input_description: + - The `configuration_path_suffix` file provides the module configuration for this test. + - The `cases_path_suffix` file provides the test cases. + """ + bucket_name = metadata['bucket_name'] + bucket_type = metadata['bucket_type'] + only_logs_after = metadata['only_logs_after'] + path_suffix = metadata['path_suffix'] + expected_results = metadata['expected_results'] + pattern = ( + fr".*No logs found in 'AWSLogs/{path_suffix}/'. " + fr"Check the provided prefix and the location of the logs for the bucket type '{bucket_type}'*" + ) + + parameters = [ + 'wodles/aws/aws-s3', + '--bucket', bucket_name, + '--aws_profile', 'qa', + '--trail_suffix', path_suffix, + '--only_logs_after', only_logs_after, + '--type', bucket_type, + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + if expected_results: + log_monitor.start( + timeout=T_20, + callback=event_monitor.callback_detect_event_processed, + error_message='The AWS module did not process the expected number of events', + ).result() + else: + with pytest.raises(TimeoutError): + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_event_processed, + ).result() + + log_monitor.start( + timeout=T_10, + callback=event_monitor.make_aws_callback(pattern), + error_message='The AWS module did not show correct message about empty path_suffix' + ).result() + + assert s3_db_exists() + + if expected_results: + data = get_s3_db_row(table_name=bucket_type) + assert f"{bucket_name}/{path_suffix}/" == data.bucket_path + assert data.log_key.startswith(f"AWSLogs/{path_suffix}/") + else: + assert not table_exists_or_has_values(table_name=bucket_type) diff --git a/tests/integration/test_aws/test_regions.py b/tests/integration/test_aws/test_regions.py new file mode 100644 index 0000000000..920dca3253 --- /dev/null +++ b/tests/integration/test_aws/test_regions.py @@ -0,0 +1,443 @@ +import os + +import pytest +from wazuh_testing import T_10, T_20, TEMPLATE_DIR, TEST_CASES_DIR, global_parameters +from wazuh_testing.modules.aws import ( # noqa: F401 + AWS_SERVICES_DB_PATH, + RANDOM_ACCOUNT_ID, + event_monitor, + local_internal_options +) +from wazuh_testing.modules.aws.db_utils import ( + get_multiple_s3_db_row, + get_multiple_service_db_row, + s3_db_exists, + table_exists_or_has_values, +) +from wazuh_testing.tools.configuration import ( + get_test_cases_data, + load_configuration_template, +) + +pytestmark = [pytest.mark.server] + + +# Generic vars +MODULE = 'regions_test_module' +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, TEMPLATE_DIR, MODULE) +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, TEST_CASES_DIR, MODULE) + +# ---------------------------------------------------- TEST_PATH ------------------------------------------------------- +t1_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'bucket_configuration_regions.yaml') +t1_cases_path = os.path.join(TEST_CASES_PATH, 'cases_bucket_regions.yaml') + +t1_configuration_parameters, t1_configuration_metadata, t1_case_ids = get_test_cases_data(t1_cases_path) +t1_configurations = load_configuration_template( + t1_configurations_path, t1_configuration_parameters, t1_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t1_configurations, t1_configuration_metadata), ids=t1_case_ids) +def test_regions( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_s3_cloudtrail_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: Only the logs for the specified region are processed. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - If a region that does not exist was specified, make sure that a message is displayed in the ossec.log + warning the user. + - Check the expected number of events were forwarded to analysisd, only logs stored in the bucket + for the specified region. + - Check the database was created and updated accordingly. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_s3_cloudtrail_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check the expected number of events were forwarded to analysisd. + - Check the database was created and updated accordingly, using the correct path for each entry. + input_description: + - The `configuration_regions` file provides the module configuration for this test. + - The `cases_regions` file provides the test cases. + """ + bucket_name = metadata['bucket_name'] + bucket_type = metadata['bucket_type'] + only_logs_after = metadata['only_logs_after'] + regions = metadata['regions'] + expected_results = metadata['expected_results'] + pattern = fr".*DEBUG: \+\+\+ No logs to process in bucket: {RANDOM_ACCOUNT_ID}/{regions}" + + parameters = [ + 'wodles/aws/aws-s3', + '--bucket', bucket_name, + '--aws_profile', 'qa', + '--only_logs_after', only_logs_after, + '--regions', regions, + '--type', bucket_type, + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + if expected_results: + log_monitor.start( + timeout=T_20, + callback=event_monitor.callback_detect_event_processed, + error_message='The AWS module did not process the expected number of events', + accum_results=expected_results + ).result() + else: + with pytest.raises(TimeoutError): + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_event_processed, + ).result() + + log_monitor.start( + timeout=T_10, + callback=event_monitor.make_aws_callback(pattern), + error_message='The AWS module did not show correct message about non-existent region' + ).result() + + assert s3_db_exists() + + if expected_results: + regions_list = regions.split(",") + for row in get_multiple_s3_db_row(table_name=bucket_type): + if hasattr(row, "aws_region"): + assert row.aws_region in regions_list + else: + assert row.log_key.split("/")[3] in regions_list + else: + assert not table_exists_or_has_values(table_name=bucket_type) + + +# -------------------------------------------- TEST_CLOUDWATCH_REGIONS ------------------------------------------------- +t2_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'cloudwatch_configuration_regions.yaml') +t2_cases_path = os.path.join(TEST_CASES_PATH, 'cases_cloudwatch_regions.yaml') + +t2_configuration_parameters, t2_configuration_metadata, t2_case_ids = get_test_cases_data(t2_cases_path) +configurations = load_configuration_template( + t2_configurations_path, t2_configuration_parameters, t2_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(configurations, t2_configuration_metadata), ids=t2_case_ids) +def test_cloudwatch_regions( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_aws_services_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: Only the logs for the specified region are processed. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - If a region that does not exist was specified, make sure that a message is displayed in the ossec.log + warning the user. + - Check the expected number of events were forwarded to analysisd, only logs stored in the bucket + for the specified region. + - Check the database was created and updated accordingly. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_aws_services_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check the expected number of events were forwarded to analysisd. + - Check the database was created and updated accordingly, using the correct path for each entry. + input_description: + - The `configuration_regions` file provides the module configuration for this test. + - The `cases_regions` file provides the test cases. + """ + service_type = metadata['service_type'] + log_group_name = metadata.get('log_group_name') + only_logs_after = metadata['only_logs_after'] + regions: str = metadata['regions'] + expected_results = metadata['expected_results'] + regions_list = regions.split(",") + + parameters = [ + 'wodles/aws/aws-s3', + '--service', service_type, + '--aws_profile', 'qa', + '--only_logs_after', only_logs_after, + '--regions', regions, + '--aws_log_groups', log_group_name, + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + if expected_results: + log_monitor.start( + timeout=T_20, + callback=event_monitor.callback_detect_service_event_processed(expected_results, service_type), + error_message='The AWS module did not process the expected number of events', + accum_results=len(regions_list) + ).result() + else: + pattern = ( + r'DEBUG: \+\+\+ \d+ events collected and processed in' if service_type == 'inspector' + else r'DEBUG: \+\+\+ Sent \d+ events to Analysisd' + ) + with pytest.raises(TimeoutError): + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.make_aws_callback(pattern), + ).result() + + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.make_aws_callback( + fr".*\+\+\+ ERROR: The region '{regions}' is not a valid one." + ), + error_message='The AWS module did not show correct message non-existent region' + ).result() + + table_name = 'cloudwatch_logs' + + if expected_results: + assert table_exists_or_has_values(table_name=table_name, db_path=AWS_SERVICES_DB_PATH) + for row in get_multiple_service_db_row(table_name=table_name): + assert (getattr(row, 'region', None) or getattr(row, 'aws_region')) in regions_list + else: + assert not table_exists_or_has_values(table_name=table_name, db_path=AWS_SERVICES_DB_PATH) + + +# ------------------------------------------ TEST_INSPECTOR_PATH ------------------------------------------------------- +t3_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'inspector_configuration_regions.yaml') +t3_cases_path = os.path.join(TEST_CASES_PATH, 'cases_inspector_regions.yaml') + +t3_configuration_parameters, t3_configuration_metadata, t3_case_ids = get_test_cases_data(t3_cases_path) +configurations = load_configuration_template( + t3_configurations_path, t3_configuration_parameters, t3_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(configurations, t3_configuration_metadata), ids=t3_case_ids) +def test_inspector_regions( + configuration, metadata, load_wazuh_basic_configuration, set_wazuh_configuration, clean_aws_services_db, + configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: Only the logs for the specified region are processed. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - If a region that does not exist was specified, make sure that a message is displayed in the ossec.log + warning the user. + - Check the expected number of events were forwarded to analysisd, only logs stored in the bucket + for the specified region. + - Check the database was created and updated accordingly. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + - Delete the uploaded file. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_aws_services_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check the expected number of events were forwarded to analysisd. + - Check the database was created and updated accordingly, using the correct path for each entry. + input_description: + - The `configuration_regions` file provides the module configuration for this test. + - The `cases_regions` file provides the test cases. + """ + service_type = metadata['service_type'] + only_logs_after = metadata['only_logs_after'] + regions: str = metadata['regions'] + expected_results = metadata['expected_results'] + regions_list = regions.split(",") + + parameters = [ + 'wodles/aws/aws-s3', + '--service', service_type, + '--aws_profile', 'qa', + '--only_logs_after', only_logs_after, + '--regions', regions, + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + if expected_results: + log_monitor.start( + timeout=T_20, + callback=event_monitor.callback_detect_service_event_processed(expected_results, service_type), + error_message='The AWS module did not process the expected number of events', + accum_results=len(regions_list) + ).result() + else: + pattern = ( + r'DEBUG: \+\+\+ \d+ events collected and processed in' if service_type == 'inspector' + else r'DEBUG: \+\+\+ Sent \d+ events to Analysisd' + ) + with pytest.raises(TimeoutError): + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.make_aws_callback(pattern), + ).result() + + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.make_aws_callback( + fr".*\+\+\+ ERROR: The region '{regions}' is not a valid one." + ), + error_message='The AWS module did not show correct message non-existent region' + ).result() + + table_name = 'aws_services' + + if expected_results: + assert table_exists_or_has_values(table_name=table_name, db_path=AWS_SERVICES_DB_PATH) + for row in get_multiple_service_db_row(table_name=table_name): + assert (getattr(row, 'region', None) or getattr(row, 'aws_region')) in regions_list + else: + assert not table_exists_or_has_values(table_name=table_name, db_path=AWS_SERVICES_DB_PATH) diff --git a/tests/integration/test_aws/test_remove_from_bucket.py b/tests/integration/test_aws/test_remove_from_bucket.py new file mode 100644 index 0000000000..8bddca8fb1 --- /dev/null +++ b/tests/integration/test_aws/test_remove_from_bucket.py @@ -0,0 +1,225 @@ +import os + +import pytest +from wazuh_testing import TEMPLATE_DIR, TEST_CASES_DIR, global_parameters +from wazuh_testing.modules.aws import event_monitor, local_internal_options # noqa: F401 +from wazuh_testing.modules.aws.cloudwatch_utils import log_stream_exists +from wazuh_testing.modules.aws.s3_utils import file_exists +from wazuh_testing.tools.configuration import ( + get_test_cases_data, + load_configuration_template, +) + +pytestmark = [pytest.mark.server] + + +# Generic vars +MODULE = 'remove_from_bucket_test_module' +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, TEMPLATE_DIR, MODULE) +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, TEST_CASES_DIR, MODULE) + +# ---------------------------------------------------- TEST_REMOVE_FROM_BUCKET ----------------------------------------- +# Configuration and cases data +t1_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_remove_from_bucket.yaml') +t1_cases_path = os.path.join(TEST_CASES_PATH, 'cases_remove_from_bucket.yaml') + +t1_configuration_parameters, t1_configuration_metadata, t1_case_ids = get_test_cases_data(t1_cases_path) +t1_configurations = load_configuration_template( + t1_configurations_path, t1_configuration_parameters, t1_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t1_configurations, t1_configuration_metadata), ids=t1_case_ids) +def test_remove_from_bucket( + configuration, metadata, mark_cases_as_skipped, upload_and_delete_file_to_s3, load_wazuh_basic_configuration, + set_wazuh_configuration, clean_s3_cloudtrail_db, configure_local_internal_options_function, + truncate_monitored_files, restart_wazuh_function, file_monitoring +): + """ + description: The uploaded file was removed after the execution. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - Check that the uploaded log was removed by the module after the execution. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - upload_and_delete_file_to_s3: + type: fixture + brief: Upload a file to S3 bucket for the day of the execution. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_s3_cloudtrail_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check in the bucket that the uploaded log was removed. + input_description: + - The `configuration_defaults` file provides the module configuration for this test. + - The `cases_defaults` file provides the test cases. + """ + bucket_name = metadata['bucket_name'] + path = metadata.get('path') + parameters = [ + 'wodles/aws/aws-s3', + '--bucket', bucket_name, + '--remove', + '--aws_profile', 'qa', + '--type', metadata['bucket_type'], + '--debug', '2' + ] + + if path is not None: + parameters.insert(6, path) + parameters.insert(6, '--trail_prefix') + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + assert not file_exists(filename=metadata['uploaded_file'], bucket_name=bucket_name) + + +# ---------------------------------------------------- TEST_REMOVE_LOG_STREAM ------------------------------------------ +# Configuration and cases data +t2_configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_remove_log_stream.yaml') +t2_cases_path = os.path.join(TEST_CASES_PATH, 'cases_remove_log_streams.yaml') + +t2_configuration_parameters, t2_configuration_metadata, t2_case_ids = get_test_cases_data(t2_cases_path) +t2_configurations = load_configuration_template( + t2_configurations_path, t2_configuration_parameters, t2_configuration_metadata +) + + +@pytest.mark.tier(level=0) +@pytest.mark.parametrize('configuration, metadata', zip(t2_configurations, t2_configuration_metadata), ids=t2_case_ids) +def test_remove_log_stream( + configuration, metadata, create_log_stream, load_wazuh_basic_configuration, set_wazuh_configuration, + clean_aws_services_db, configure_local_internal_options_function, truncate_monitored_files, restart_wazuh_function, + file_monitoring +): + """ + description: The created log stream was removed after the execution. + test_phases: + - setup: + - Load Wazuh light configuration. + - Apply ossec.conf configuration changes according to the configuration template and use case. + - Apply custom settings in local_internal_options.conf. + - Truncate wazuh logs. + - Restart wazuh-manager service to apply configuration changes. + - test: + - Check in the ossec.log that a line has appeared calling the module with correct parameters. + - Check that the created log stream was removed by the module after the execution. + - teardown: + - Truncate wazuh logs. + - Restore initial configuration, both ossec.conf and local_internal_options.conf. + wazuh_min_version: 4.5.0 + parameters: + - configuration: + type: dict + brief: Get configurations from the module. + - metadata: + type: dict + brief: Get metadata from the module. + - create_log_stream: + type: fixture + brief: Create a log stream with events for the day of execution. + - load_wazuh_basic_configuration: + type: fixture + brief: Load basic wazuh configuration. + - set_wazuh_configuration: + type: fixture + brief: Apply changes to the ossec.conf configuration. + - clean_aws_services_db: + type: fixture + brief: Delete the DB file before and after the test execution. + - configure_local_internal_options_function: + type: fixture + brief: Apply changes to the local_internal_options.conf configuration. + - truncate_monitored_files: + type: fixture + brief: Truncate wazuh logs. + - restart_wazuh_daemon_function: + type: fixture + brief: Restart the wazuh service. + - file_monitoring: + type: fixture + brief: Handle the monitoring of a specified file. + assertions: + - Check in the log that the module was called with correct parameters. + - Check in the log group that the created stream was removed. + input_description: + - The `configuration_defaults` file provides the module configuration for this test. + - The `cases_defaults` file provides the test cases. + """ + service_type = metadata['service_type'] + log_group_name = metadata['log_group_name'] + + parameters = [ + 'wodles/aws/aws-s3', + '--service', service_type, + '--aws_profile', 'qa', + '--regions', 'us-east-1', + '--aws_log_groups', log_group_name, + '--remove-log-streams', + '--debug', '2' + ] + + # Check AWS module started + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_start, + error_message='The AWS module did not start as expected', + ).result() + + # Check command was called correctly + log_monitor.start( + timeout=global_parameters.default_timeout, + callback=event_monitor.callback_detect_aws_module_called(parameters), + error_message='The AWS module was not called with the correct parameters', + ).result() + + assert not log_stream_exists(log_stream=metadata['log_stream'], log_group=log_group_name) From 4152d049e8d38bbb49aed6c98e89e44e8ddf54aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julia=20Mag=C3=A1n?= <80041853+juliamagan@users.noreply.github.com> Date: Tue, 2 May 2023 09:39:49 +0200 Subject: [PATCH 26/34] feat(#4135): update changelog --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d6d9c8db2e..2e3f10aeca 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -137,6 +137,11 @@ Release report: https://github.com/wazuh/wazuh/issues/15504 - Remove all FIM Integration skipped tests ([#2927](https://github.com/wazuh/wazuh-qa/issues/2927)) \- (Framework + Tests) - VDT ITs: Remove Debian Stretch test support. ([#3172](https://github.com/wazuh/wazuh-qa/pull/3172)) \- (Tests) +## [4.3.11] - 20-04-2023 + +Wazuh commit: https://github.com/wazuh/wazuh/commit/776fda906581a1e4ee170c3e7e73a58d69e41f95 \ +Release report: https://github.com/wazuh/wazuh/issues/16758 + ## [4.3.10] - 16-11-2022 Wazuh commit: https://github.com/wazuh/wazuh/commit/89530f11c9e592cd2e551432209b0080f08ff8e5 \ From 947106bebea3ec50b440aad9c442ad47f5653257 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julia=20Mag=C3=A1n?= <80041853+juliamagan@users.noreply.github.com> Date: Tue, 2 May 2023 09:57:42 +0200 Subject: [PATCH 27/34] refactor(#4137): change when the check is executed * refactor(#4137): change when the check is executed * fix(#4137): revert draft condition --- .github/workflows/changelog.yaml | 3 +++ .github/workflows/code_analysis.yaml | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/changelog.yaml b/.github/workflows/changelog.yaml index 16d4f8f039..9baad5c564 100644 --- a/.github/workflows/changelog.yaml +++ b/.github/workflows/changelog.yaml @@ -1,6 +1,9 @@ name: Changelog on: pull_request: + types: + - opened + - ready_for_review branches: - master - '[0-9]+.[0-9]+' diff --git a/.github/workflows/code_analysis.yaml b/.github/workflows/code_analysis.yaml index 19a3899b63..5419dcb918 100644 --- a/.github/workflows/code_analysis.yaml +++ b/.github/workflows/code_analysis.yaml @@ -1,6 +1,9 @@ name: Code analysis on: - pull_request + pull_request: + types: + - opened + - ready_for_review jobs: Linting: if: ${{ !github.event.pull_request.draft }} From e47d636413f1b4435b406378f70497dc0e9aacce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julia=20Mag=C3=A1n?= <80041853+juliamagan@users.noreply.github.com> Date: Tue, 2 May 2023 10:39:14 +0200 Subject: [PATCH 28/34] merge(#4135)!: merge 4.4 into 4.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(3862): fix test_assign_agent_group_with_enrollment * fix(#3862): delete default group check * feat(#3862): update changelog * refactor(#3862): add expected logs * fix(#4047): fix duplicated slash in API endpoint (#4048) * refactor: update changelog * refactor: bump version to 4.3.10 * refactor: update changelog --------- Co-authored-by: jmv74211 * feat: update changelog for 4.4.1 tag (#4084) * fix(#4079): fix unstable system tests * fix(#4079): test active response log format * fix(#4079): remove log monitor to avoid race condition * fix(#4079): internal option fixture call * fix(#4079): enrollment cluster log path typo * docs(#4070): include missing tests in README * feat(#4079): include marks to system tests * docs(#4070): update changelog * docs(#4079): restore deleted commentary * docs(#4079): move pr changes to fixed category * fix(#3942): fix agentd IT for python310 * fix(#3942): include simulator teardown * style(#3943): pep8 * docs(#3942): include 3973 changelog * docs(#3942): move pr changes to fixed category * refactor(#3942): remove unnecessary scopes * docs(#3942): change changelog pr entry * docs(#3942): move change to 4.4.2 * docs(#3942): include teardown documentation * feat(#3912): add tests for groups deletion * feat(#3912): add function to get group id * feat(#3912): add test for group deletion * feat(#3912): add test cases * fix(#3912): fix linter errors * feat(#3912): update changelog * fix(#3912): fix typo * docs(#3912): improve description * fix(#3912): change import * docs(#3912): improve documentation * fix(#3912): delete created group during tear down * docs(#3912): add documentation * refactor(#3912)!: change delete function and test cases * refactor(#3912): change affected tests * feat(#3912): store binary path * docs(#3912): add function documentation * fix(#3912): update changelog * feat(#4089): bump version to 4.4.2 * feat(#4089): bump version to 4.4.2 * refactor(#4089): change revision * feat(#3545): add test to check the syscollector configuration * feat(#3545): add test to check the syscollector configuration. * fix(#3545): fix errors when running tests in agents. * fix(#3545): modify the way the test restarts deamons. * fix(#3545): fix syscollector DB path in Windows. * fix(#3545): fix syscollector db path variable name. * fix(#3545): fix globalDB error due to execution in agent. * style(#3545): fix linter errors. * docs(#3545): add PR to changelog. * fix(#3545): fix some errors present in Windows tests. * fix(#3545): fix file monitor declaration. * fix(#3545): fix all_scans_disabled test. * refactor(#3545): change the timeout of filemonitor. * fix(#3545): fix macOS tests. * refactor(#3545): add mark to run the test on unix only. * fix(#3545): fix Windows tests. * docs(#3545): mark test as xfail because of an existing bug. * fix(#3545): remove the mark from unix tests. * fix(#3545): reuse an existing function and remove the utilized. * style(#3545): apply identation. * fix(#3545): fix naming and used functions. * fix(#3545): move fixture to integration conftest. * fix(#3545): improve a function name. * refactor(#3545): add new case, disable unused modules and minor changes. * fix(#3545): fix prefix. * fix(#3545): fix metadata because NoneType error. * fix(#3545): fix event monitor and truncate function. * refactor(#3545): remove the max_eps empty test case. It is not a critical field, so it will not thrown an error when empty. * fix(#3545): solve the log position problem when searching a message. * fix(#3545): apply linter corrections. * fix(#3545): fix the test configuration data. * fix(#3545): remove unused import and docs changed. * fix(#3545): change way of importing and minor changes. * fix(#3545): use param depending on the platform. * refactor(#3545): remove unused fixture and change callback. * fix(#3545): change the default argument for prefix. * style(#3545): add spaces for better visualization. * refactor(#3545): improve docs and change some logic. * docs(#3545): add comments and new documentation. * fix(#3545): fix NoneType error. * docs(#3545): fix changelog. * docs(#3545): add docs for file_to_monitor param. Improve existing docs. * refactor(#3545): remove duplicated function and improve documentation * fix(#3545): remove unused imports and sort the remaining ones. * docs(#3545): add docs to wrapped fixture. * fix(#3545): remove xfail mark and add note to mark. * docs(#3545): remove duplicated line. * style(#3545): sort imports according the guidelines. * docs(#3545): move change to 4.4.2 section in CHANGELOG. * fix(#4111): fix WazuhDB IT * fix(#4111): make_callback function * fix(#4111): typo in set agent groups tcases * fix(#4111): stop agent simulator after test end * docs(#4111): update changelog * fix(#4123): fix gcloud tests * fix(#4123): fix daemons_handler fixture. * fix(#4123): remove some analysisd on test_gcloud * fix(#4123): change test_logging fixtures to module * fix(#4123): start analysisd in test max messages * docs(#4123): add fix to CHANGELOG. --------- Co-authored-by: jnasselle Co-authored-by: Víctor Rebollo Pérez * feat(#4135): update changelog * refactor(#4137): change when the check is executed * refactor(#4137): change when the check is executed * fix(#4137): revert draft condition --------- Co-authored-by: José Luis López Sánchez Co-authored-by: jmv74211 Co-authored-by: Víctor Rebollo Pérez Co-authored-by: Mauro Agustín Malara Zapata <39094716+mauromalara@users.noreply.github.com> Co-authored-by: jnasselle --- .github/workflows/changelog.yaml | 3 + .github/workflows/code_analysis.yaml | 5 +- CHANGELOG.md | 15 +- conftest.py | 2 +- deps/wazuh_testing/wazuh_testing/__init__.py | 3 + .../wazuh_testing/event_monitor.py | 18 +- .../wazuh_testing/modules/__init__.py | 12 +- .../modules/syscollector/__init__.py | 0 .../modules/syscollector/event_monitor.py | 311 ++++++++++++ .../wazuh_testing/qa_docs/schema.yaml | 2 + .../wazuh_testing/tools/configuration.py | 7 +- tests/integration/conftest.py | 38 +- tests/integration/test_gcloud/conftest.py | 4 +- .../test_configuration/test_invalid.py | 1 - .../test_remote_configuration.py | 1 - .../test_configuration/test_schedule.py | 1 - .../test_functionality/test_day_wday.py | 1 - .../test_functionality/test_interval.py | 1 - .../test_functionality/test_logging.py | 19 +- .../test_functionality/test_max_messages.py | 9 +- .../test_functionality/test_pull_on_start.py | 1 - .../configuration_syscollector.yaml | 53 +++ .../configuration_syscollector_no_tags.yaml | 26 + ...iguration_syscollector_scans_disabled.yaml | 49 ++ .../case_test_all_scans_disabled.yaml | 26 + .../test_cases/case_test_default_values.yaml | 5 + .../case_test_invalid_configurations.yaml | 436 +++++++++++++++++ .../data/test_cases/case_test_scanning.yaml | 17 + .../case_test_syscollector_deactivation.yaml | 28 ++ .../test_syscollector_configuration.py | 446 ++++++++++++++++++ .../data/global/set_agent_groups.yaml | 4 +- .../test_agent_database_version.py | 3 + 32 files changed, 1486 insertions(+), 61 deletions(-) create mode 100644 deps/wazuh_testing/wazuh_testing/modules/syscollector/__init__.py create mode 100644 deps/wazuh_testing/wazuh_testing/modules/syscollector/event_monitor.py create mode 100644 tests/integration/test_syscollector/data/configuration/configuration_syscollector.yaml create mode 100644 tests/integration/test_syscollector/data/configuration/configuration_syscollector_no_tags.yaml create mode 100644 tests/integration/test_syscollector/data/configuration/configuration_syscollector_scans_disabled.yaml create mode 100644 tests/integration/test_syscollector/data/test_cases/case_test_all_scans_disabled.yaml create mode 100644 tests/integration/test_syscollector/data/test_cases/case_test_default_values.yaml create mode 100644 tests/integration/test_syscollector/data/test_cases/case_test_invalid_configurations.yaml create mode 100644 tests/integration/test_syscollector/data/test_cases/case_test_scanning.yaml create mode 100644 tests/integration/test_syscollector/data/test_cases/case_test_syscollector_deactivation.yaml create mode 100644 tests/integration/test_syscollector/test_syscollector_configuration.py diff --git a/.github/workflows/changelog.yaml b/.github/workflows/changelog.yaml index 16d4f8f039..9baad5c564 100644 --- a/.github/workflows/changelog.yaml +++ b/.github/workflows/changelog.yaml @@ -1,6 +1,9 @@ name: Changelog on: pull_request: + types: + - opened + - ready_for_review branches: - master - '[0-9]+.[0-9]+' diff --git a/.github/workflows/code_analysis.yaml b/.github/workflows/code_analysis.yaml index 19a3899b63..5419dcb918 100644 --- a/.github/workflows/code_analysis.yaml +++ b/.github/workflows/code_analysis.yaml @@ -1,6 +1,9 @@ name: Code analysis on: - pull_request + pull_request: + types: + - opened + - ready_for_review jobs: Linting: if: ${{ !github.event.pull_request.draft }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ed3507da8..9bdd11611a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,10 +2,7 @@ All notable changes to this project will be documented in this file. -## [4.5.0] - Development (unreleased) - -Wazuh commit: TBD \ -Release report: TBD +## [4.5.0] - TBD ### Added @@ -43,14 +40,17 @@ Release report: TBD - Fix an error in the cluster performance tests related to CSV parser ([#2999](https://github.com/wazuh/wazuh-qa/pull/2999)) \- (Framework + Tests) - Fix bug in the framework on migration tool ([#2999](https://github.com/wazuh/wazuh-qa/pull/4027)) \- (Framework) -## [4.4.2] - Development (unreleased) +## [4.4.2] - TBD ### Added +- Add test to check the Syscollector configuration. ([#3584](https://github.com/wazuh/wazuh-qa/pull/3584)) \- (Framework + Tests) - Add system tests for groups deletion ([#4057](https://github.com/wazuh/wazuh-qa/pull/4057)) \- (Tests) ### Fixed +- Fix daemons_handler fixture (fix GCP IT) ([#4134](https://github.com/wazuh/wazuh-qa/pull/4134)) \- (Tests) +- Fix wazuhdb IT. ([#3584](https://github.com/wazuh/wazuh-qa/pull/3584)) \- (Framework + Tests) - Fix agentd IT for python3.10 AMI ([#3973](https://github.com/wazuh/wazuh-qa/pull/3973)) \- (Tests) - Fix unstable system tests ([#4080](https://github.com/wazuh/wazuh-qa/pull/4080)) \- (Tests) @@ -178,6 +178,11 @@ Release report: https://github.com/wazuh/wazuh/issues/15504 - Remove all FIM Integration skipped tests ([#2927](https://github.com/wazuh/wazuh-qa/issues/2927)) \- (Framework + Tests) - VDT ITs: Remove Debian Stretch test support. ([#3172](https://github.com/wazuh/wazuh-qa/pull/3172)) \- (Tests) +## [4.3.11] - 20-04-2023 + +Wazuh commit: https://github.com/wazuh/wazuh/commit/776fda906581a1e4ee170c3e7e73a58d69e41f95 \ +Release report: https://github.com/wazuh/wazuh/issues/16758 + ## [4.3.10] - 16-11-2022 Wazuh commit: https://github.com/wazuh/wazuh/commit/89530f11c9e592cd2e551432209b0080f08ff8e5 \ diff --git a/conftest.py b/conftest.py index bb61a281ed..d465af7d28 100644 --- a/conftest.py +++ b/conftest.py @@ -1,6 +1,6 @@ import pytest + def pytest_collectreport(report): if report.failed: pass - diff --git a/deps/wazuh_testing/wazuh_testing/__init__.py b/deps/wazuh_testing/wazuh_testing/__init__.py index 2972b10f57..0f261d7c83 100644 --- a/deps/wazuh_testing/wazuh_testing/__init__.py +++ b/deps/wazuh_testing/wazuh_testing/__init__.py @@ -13,12 +13,14 @@ if sys.platform == 'win32': WAZUH_PATH = os.path.join("C:", os.sep, "Program Files (x86)", "ossec-agent") LOG_FILE_PATH = os.path.join(WAZUH_PATH, 'ossec.log') + SYSCOLLECTOR_DB_PATH = os.path.join(WAZUH_PATH, 'queue', 'syscollector', 'db', 'local.db') else: if sys.platform == 'darwin': WAZUH_PATH = os.path.join("/", "Library", "Ossec") else: WAZUH_PATH = os.path.join("/var", "ossec") LOG_FILE_PATH = os.path.join(WAZUH_PATH, 'logs', 'ossec.log') + SYSCOLLECTOR_DB_PATH = os.path.join(WAZUH_PATH, 'queue', 'syscollector', 'db', 'local.db') WAZUH_CONF_PATH = os.path.join(WAZUH_PATH, 'etc', 'ossec.conf') @@ -68,6 +70,7 @@ ANALYSISD_STATE = os.path.join(WAZUH_PATH, 'var', 'run', 'wazuh-analysisd.state') # Timeouts +T_2 = 2 T_5 = 5 T_10 = 10 T_20 = 20 diff --git a/deps/wazuh_testing/wazuh_testing/event_monitor.py b/deps/wazuh_testing/wazuh_testing/event_monitor.py index 5bc4a56839..b52bc6b8fd 100644 --- a/deps/wazuh_testing/wazuh_testing/event_monitor.py +++ b/deps/wazuh_testing/wazuh_testing/event_monitor.py @@ -5,35 +5,39 @@ def make_callback(pattern, prefix=''): """Create a callback function from a text pattern. + Args: - pattern (str): String to match on the log. + pattern (str): string to match on the log. prefix (str): regular expression used as prefix before the pattern. + Returns: lambda: function that returns if there's a match in the file """ pattern = r'\s+'.join(pattern.split()) - regex = re.compile(r'{}{}'.format(prefix, pattern)) + regex = re.compile(r'{}{}'.format(prefix, pattern)) if prefix else re.compile(pattern) return lambda line: regex.match(line) def check_event(file_monitor=None, callback='', error_message=None, update_position=True, timeout=20, - accum_results=1, file_to_monitor=None): - """Check if an API event occurs + accum_results=1, file_to_monitor=None, prefix=None): + """Check if an event occurs. + Args: file_monitor (FileMonitor): FileMonitor object to monitor the file content. callback (str): log regex to check in the file error_message (str): error message to show in case of expected event does not occur update_position (boolean): filter configuration parameter to search in the file + accum_results (int): accumulation of matches. + file_to_monitor (str): path to the file to be monitored. timeout (str): timeout to check the event in the file - prefix (str): log pattern regex - accum_results (int): Accumulation of matches. + prefix (str): prefix of the log message regex """ file_monitor = FileMonitor(file_to_monitor) if file_monitor is None else file_monitor error_message = f"Could not find this event in {file_to_monitor}: {callback}" if error_message is None else \ error_message result = file_monitor.start(timeout=timeout, update_position=update_position, accum_results=accum_results, - callback=make_callback(callback), error_message=error_message) + callback=make_callback(callback, prefix), error_message=error_message) return result diff --git a/deps/wazuh_testing/wazuh_testing/modules/__init__.py b/deps/wazuh_testing/wazuh_testing/modules/__init__.py index d9a289651c..85d695795d 100644 --- a/deps/wazuh_testing/wazuh_testing/modules/__init__.py +++ b/deps/wazuh_testing/wazuh_testing/modules/__init__.py @@ -1,15 +1,13 @@ -# Copyright (C) 2015-2023, Wazuh Inc. -# Created by Wazuh, Inc. . -# This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 - ''' -The purpose of this file is to contain all the variables necessary for Wazuh in order to be easier -to maintain if one of them changes in the future. +copyright: Copyright (C) 2015-2023, Wazuh Inc. + Created by Wazuh, Inc. . + This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 ''' import pytest -WAZUH_SERVICE_PREFIX = 'wazuh' +# Services Variables WAZUH_SERVICES_STOPPED = 'stopped' +WAZUH_SERVICE_PREFIX = 'wazuh' WAZUH_SERVICES_STOP = 'stop' WAZUH_SERVICES_START = 'start' diff --git a/deps/wazuh_testing/wazuh_testing/modules/syscollector/__init__.py b/deps/wazuh_testing/wazuh_testing/modules/syscollector/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/deps/wazuh_testing/wazuh_testing/modules/syscollector/event_monitor.py b/deps/wazuh_testing/wazuh_testing/modules/syscollector/event_monitor.py new file mode 100644 index 0000000000..cdb537151b --- /dev/null +++ b/deps/wazuh_testing/wazuh_testing/modules/syscollector/event_monitor.py @@ -0,0 +1,311 @@ +""" +copyright: Copyright (C) 2015-2023, Wazuh Inc. + Created by Wazuh, Inc. . + This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 +""" +import sys + +from wazuh_testing import T_5 +from wazuh_testing.event_monitor import check_event + + +# Define the log messages prefix +SYSCOLLECTOR_PREFIX = '.+wazuh-modulesd:syscollector.+' +WMODULES_SYSCOLLECTOR_PREFIX = '.+wmodules_syscollector.+' + +# Callback messages +CB_MODULE_STARTING = 'DEBUG: Starting Syscollector.' +CB_MODULE_STARTED = 'INFO: Module started.' +CB_SCAN_STARTED = 'INFO: Starting evaluation.' +CB_SCAN_FINISHED = 'INFO: Evaluation finished.' +CB_SYNC_STARTED = 'DEBUG: Starting syscollector sync' +CB_SYNC_FINISHED = 'DEBUG: Ending syscollector sync' +CB_SYSCOLLECTOR_DISABLED = 'INFO: Module disabled. Exiting...' +CB_HARDWARE_SCAN_STARTED = 'DEBUG: Starting hardware scan' +CB_HARDWARE_SCAN_FINISHED = 'DEBUG: Ending hardware scan' +CB_OS_SCAN_STARTED = 'DEBUG: Starting os scan' +CB_OS_SCAN_FINISHED = 'DEBUG: Ending os scan' +CB_NETWORK_SCAN_STARTED = 'DEBUG: Starting network scan' +CB_NETWORK_SCAN_FINISHED = 'DEBUG: Ending network scan' +CB_PACKAGES_SCAN_STARTED = 'DEBUG: Starting packages scan' +CB_PACKAGES_SCAN_FINISHED = 'DEBUG: Ending packages scan' +CB_PORTS_SCAN_STARTED = 'DEBUG: Starting ports scan' +CB_PORTS_SCAN_FINISHED = 'DEBUG: Ending ports scan' +CB_PROCESSES_SCAN_STARTED = 'DEBUG: Starting processes scan' +CB_PROCESSES_SCAN_FINISHED = 'DEBUG: Ending processes scan' +CB_HOTFIXES_SCAN_STARTED = 'DEBUG: Starting hotfixes scan' +CB_HOTFIXES_SCAN_FINISHED = 'DEBUG: Ending hotfixes scan' + + +def check_module_is_starting(file_monitor=None, timeout=T_5): + """Check if the syscollector module is starting. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_MODULE_STARTING, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_module_startup_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector startup was completed. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_MODULE_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_sync_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector synchronization has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_SYNC_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_syscollector_is_disabled(file_monitor=None, timeout=T_5): + """Check if the syscollector module is disabled. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_SYSCOLLECTOR_DISABLED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_config(disabled='no', interval=3600, scan_on_start='yes', hardware='yes', os='yes', ports='yes', + network='yes', packages='yes', ports_all='no', processes='yes', hotfixes='yes', max_eps=10, + file_monitor=None, timeout=T_5): + """Check if the syscollector configuration was applied correctly. + + Args: + disabled (str): Disable the Syscollector wodle. + interval (int): Time between system scans. + scan_on_start (str): Run a system scan immediately when service is started. + hardware (str): Enables the hardware scan. + os (str): Enables the OS scan. + ports (str): Enables the ports scan. + network (str): Enables the network scan. + packages (str): Enables the packages scan. + ports_all (str): Make Wazuh only scans listening ports. + processes (str): Enables the processes scan. + hotfixes (str): Enables the hotfixes scan. + max_eps (int): Sets the maximum event reporting throughput. + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + msg = 'DEBUG:.+"disabled":"{0}","scan-on-start":"{1}","interval":{2},'.format(disabled, scan_on_start, interval) + msg += '"network":"{0}","os":"{1}","hardware":"{2}","packages":"{3}","ports":"{4}",'.format(network, os, hardware, + packages, ports) + msg += '"ports_all":"{0}","processes":"{1}",'.format(ports_all, processes) + if sys.platform == 'win32': + msg += '"hotfixes":"{0}",'.format(hotfixes) + msg += '"sync_max_eps":{0}.+'.format(max_eps) + + check_event(callback=msg, timeout=timeout, file_monitor=file_monitor) + + +def check_hardware_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector hardware scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_HARDWARE_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_hardware_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector OS scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_HARDWARE_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_os_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector OS scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_OS_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_os_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector OS scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_OS_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_network_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector network scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_NETWORK_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_network_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector network scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_NETWORK_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_packages_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector packages scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PACKAGES_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_packages_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector packages scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PACKAGES_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_ports_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector ports scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PORTS_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_ports_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector ports scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PORTS_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) + + +def check_processes_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector processes scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PROCESSES_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_processes_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector processes scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_PROCESSES_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_hotfixes_scan_started(file_monitor=None, timeout=T_5): + """Check if the syscollector hotfixes scan has started. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_HOTFIXES_SCAN_STARTED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_hotfixes_scan_finished(file_monitor=None, timeout=T_5): + """Check if the syscollector hotfixes scan has finished. + + Args: + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + check_event(callback=CB_HOTFIXES_SCAN_FINISHED, timeout=timeout, prefix=SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_tag_error(field='', file_monitor=None, timeout=T_5): + """Check if syscollector shows an error when using an invalid value in a tag. + + Args: + field (str): field that contains the error. + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + callbacks_options = { + 'max_eps': "WARNING:.+ Invalid value for element 'max_eps': .+", + 'interval': "ERROR: Invalid interval at module 'syscollector'", + 'all': f"ERROR: Invalid content for tag '{field}' at module 'syscollector'." + } + selected_callback = callbacks_options['all'] if field not in callbacks_options.keys() else callbacks_options[field] + + check_event(callback=selected_callback, timeout=timeout, prefix=WMODULES_SYSCOLLECTOR_PREFIX, + file_monitor=file_monitor) + + +def check_attr_error(attr='', file_monitor=None, timeout=T_5): + """Check if syscollector shows an error when using an invalid value in an attribute. + + Args: + attr (str): attribute that contains the error. + file_monitor (FileMonitor): FileMonitor object to monitor the file content. + timeout (str): timeout to check the event in Wazuh log + """ + callback = f"ERROR: Invalid content for attribute '{attr}' at module 'syscollector'." + check_event(callback=callback, timeout=timeout, prefix=WMODULES_SYSCOLLECTOR_PREFIX, file_monitor=file_monitor) diff --git a/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml b/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml index 3bf79b0f40..9faacf05dd 100644 --- a/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml +++ b/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml @@ -65,6 +65,7 @@ predefined_values: - integration - logcollector - logtest + - modulesd - office365 - osquery - remoted @@ -354,6 +355,7 @@ predefined_values: - settings - shellshock - simulator + - syscollector - slack - sql_injection - ssh diff --git a/deps/wazuh_testing/wazuh_testing/tools/configuration.py b/deps/wazuh_testing/wazuh_testing/tools/configuration.py index 628c250673..0b1ed61c1b 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/configuration.py +++ b/deps/wazuh_testing/wazuh_testing/tools/configuration.py @@ -486,7 +486,12 @@ def inserter(path): for config in configurations: for section in config['sections']: - if section['elements']: + # Capture exception if there is no elements in the section + try: + elements = section['elements'] + except KeyError: + elements = None + if elements is not None: for element in section['elements']: if isinstance(element, dict): # ADD HERE all fields with format sub_element: - value diff --git a/tests/integration/conftest.py b/tests/integration/conftest.py index 0793ac144f..42741892d4 100644 --- a/tests/integration/conftest.py +++ b/tests/integration/conftest.py @@ -15,25 +15,24 @@ from numpydoc.docscrape import FunctionDoc from py.xml import html -import wazuh_testing.tools.configuration as conf -from wazuh_testing import global_parameters, logger, ALERTS_JSON_PATH, ARCHIVES_LOG_PATH, ARCHIVES_JSON_PATH +from wazuh_testing import ALERTS_JSON_PATH, ARCHIVES_JSON_PATH, ARCHIVES_LOG_PATH, global_parameters, logger, mocking +from wazuh_testing.db_interface.agent_db import update_os_info +from wazuh_testing.db_interface.global_db import get_system, modify_system from wazuh_testing.logcollector import create_file_structure, delete_file_structure from wazuh_testing.tools import (PREFIX, LOG_FILE_PATH, WAZUH_CONF, get_service, ALERT_FILE_PATH, WAZUH_LOCAL_INTERNAL_OPTIONS) -from wazuh_testing.tools.configuration import get_wazuh_conf, set_section_wazuh_conf, write_wazuh_conf -from wazuh_testing.tools.file import truncate_file, recursive_directory_creation, remove_file, copy, write_file -from wazuh_testing.tools.monitoring import QueueMonitor, FileMonitor, SocketController, close_sockets -from wazuh_testing.tools.services import control_service, check_daemon_status, delete_dbs +from wazuh_testing.tools.configuration import get_minimal_configuration, get_wazuh_conf, write_wazuh_conf +from wazuh_testing.tools.file import copy, recursive_directory_creation, remove_file, truncate_file, write_file +from wazuh_testing.tools.monitoring import FileMonitor, QueueMonitor, SocketController, close_sockets +from wazuh_testing.tools.services import check_daemon_status, control_service, delete_dbs from wazuh_testing.tools.time import TimeMachine -from wazuh_testing import mocking -from wazuh_testing.db_interface.agent_db import update_os_info -from wazuh_testing.db_interface.global_db import get_system, modify_system -from wazuh_testing.tools.run_simulator import syslog_simulator -from wazuh_testing.tools.configuration import get_minimal_configuration +import wazuh_testing.tools.configuration as conf if sys.platform == 'win32': - from wazuh_testing.fim import KEY_WOW64_64KEY, KEY_WOW64_32KEY, delete_registry, registry_parser, create_registry + from wazuh_testing.fim import (KEY_WOW64_32KEY, KEY_WOW64_64KEY, + create_registry, delete_registry, + registry_parser) PLATFORMS = set("darwin linux win32 sunos5".split()) HOST_TYPES = set("server agent".split()) @@ -919,7 +918,7 @@ def daemons_handler(get_configuration, request): in order to use this fixture along with invalid configuration. Default `False` Args: - get_configuration (fixture): Gets the current configuration of the test. + get_configuration (fixture): Get configurations from the module. Allows this fixture to be used for each param. request (fixture): Provide information on the executing test function. """ daemons = [] @@ -977,6 +976,10 @@ def daemons_handler(get_configuration, request): control_service('stop', daemon=daemon) +# Wrapper of `daemons_handler` function to change its scope from `module` to `function` +daemons_handler_function = pytest.fixture(daemons_handler.__wrapped__, scope='function') + + @pytest.fixture(scope='function') def file_monitoring(request): """Fixture to handle the monitoring of a specified file. @@ -1027,14 +1030,13 @@ def set_wazuh_configuration(configuration): conf.write_wazuh_conf(backup_config) -@pytest.fixture() +@pytest.fixture def truncate_monitored_files(): """Truncate all the log files and json alerts files before and after the test execution""" - - if 'agent' in get_service(): - log_files = [LOG_FILE_PATH] - else: + if get_service() == 'wazuh-manager': log_files = [LOG_FILE_PATH, ALERT_FILE_PATH] + else: + log_files = [LOG_FILE_PATH] for log_file in log_files: if os.path.isfile(os.path.join(PREFIX, log_file)): diff --git a/tests/integration/test_gcloud/conftest.py b/tests/integration/test_gcloud/conftest.py index d51c1494f9..caad609e06 100644 --- a/tests/integration/test_gcloud/conftest.py +++ b/tests/integration/test_gcloud/conftest.py @@ -11,6 +11,7 @@ from wazuh_testing.gcloud import detect_gcp_start, publish_sync import wazuh_testing.tools.configuration as conf + @pytest.fixture(scope='session', autouse=True) def handle_credentials_file(): if global_parameters.gcp_credentials is None or global_parameters.gcp_credentials_file is None: @@ -50,10 +51,11 @@ def wait_for_gcp_start(get_configuration, request): file_monitor = getattr(request.module, 'wazuh_log_monitor') detect_gcp_start(file_monitor) + @pytest.fixture(scope="session", autouse=True) def configure_internal_options(): local_internal_options = {'wazuh_modules.debug': 2, 'analysisd.debug': 2, 'monitord.rotate_log': 0, 'monitord.day_wait': 0, 'monitord.keep_log_days': 0,'monitord.size_rotate': 0} conf.set_local_internal_options_dict(local_internal_options) yield local_internal_options = {'wazuh_modules.debug': 0, 'analysisd.debug': 0, "monitord.rotate_log": 1, "monitord.day_wait": 10, "monitord.keep_log_days": 31,'monitord.size_rotate': 512} - conf.set_local_internal_options_dict(local_internal_options) \ No newline at end of file + conf.set_local_internal_options_dict(local_internal_options) diff --git a/tests/integration/test_gcloud/test_configuration/test_invalid.py b/tests/integration/test_gcloud/test_configuration/test_invalid.py index cdcee3a31a..eb9ec95cff 100644 --- a/tests/integration/test_gcloud/test_configuration/test_invalid.py +++ b/tests/integration/test_gcloud/test_configuration/test_invalid.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd diff --git a/tests/integration/test_gcloud/test_configuration/test_remote_configuration.py b/tests/integration/test_gcloud/test_configuration/test_remote_configuration.py index 30057e3a9f..2d076bb99c 100644 --- a/tests/integration/test_gcloud/test_configuration/test_remote_configuration.py +++ b/tests/integration/test_gcloud/test_configuration/test_remote_configuration.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd diff --git a/tests/integration/test_gcloud/test_configuration/test_schedule.py b/tests/integration/test_gcloud/test_configuration/test_schedule.py index 4849be435b..166e468f8a 100644 --- a/tests/integration/test_gcloud/test_configuration/test_schedule.py +++ b/tests/integration/test_gcloud/test_configuration/test_schedule.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd diff --git a/tests/integration/test_gcloud/test_functionality/test_day_wday.py b/tests/integration/test_gcloud/test_functionality/test_day_wday.py index 894124fbfb..a84e45ca45 100644 --- a/tests/integration/test_gcloud/test_functionality/test_day_wday.py +++ b/tests/integration/test_gcloud/test_functionality/test_day_wday.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd diff --git a/tests/integration/test_gcloud/test_functionality/test_interval.py b/tests/integration/test_gcloud/test_functionality/test_interval.py index 72d725d43c..c239bcf048 100644 --- a/tests/integration/test_gcloud/test_functionality/test_interval.py +++ b/tests/integration/test_gcloud/test_functionality/test_interval.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd diff --git a/tests/integration/test_gcloud/test_functionality/test_logging.py b/tests/integration/test_gcloud/test_functionality/test_logging.py index ac47ac92e1..92f9f5a291 100644 --- a/tests/integration/test_gcloud/test_functionality/test_logging.py +++ b/tests/integration/test_gcloud/test_functionality/test_logging.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd @@ -76,7 +75,7 @@ # configurations -daemons_handler_configuration = {'daemons': ['wazuh-analysisd', 'wazuh-modulesd']} +daemons_handler_configuration = {'daemons': ['wazuh-modulesd']} monitoring_modes = ['scheduled'] conf_params = {'PROJECT_ID': global_parameters.gcp_project_id, 'SUBSCRIPTION_NAME': global_parameters.gcp_subscription_name, @@ -94,14 +93,14 @@ # fixtures -@pytest.fixture(scope='package', params= [ - {'wazuh_modules.debug': 0, 'analysisd.debug': 2, +@pytest.fixture(scope='module', params= [ + {'wazuh_modules.debug': 0, 'monitord.rotate_log': 0, 'monitord.day_wait': 0, 'monitord.keep_log_days': 0, 'monitord.size_rotate': 0}, - {'wazuh_modules.debug': 1, 'analysisd.debug': 2, + {'wazuh_modules.debug': 1, 'monitord.rotate_log': 0, 'monitord.day_wait': 0, 'monitord.keep_log_days': 0, 'monitord.size_rotate': 0}, - {'wazuh_modules.debug': 2, 'analysisd.debug': 2, + {'wazuh_modules.debug': 2, 'monitord.rotate_log': 0, 'monitord.day_wait': 0, 'monitord.keep_log_days': 0, 'monitord.size_rotate': 0} ]) @@ -110,8 +109,8 @@ def get_local_internal_options(request): return request.param -@pytest.fixture(scope='package') -def configure_local_internal_options_package(get_local_internal_options): +@pytest.fixture(scope='module') +def configure_local_internal_options_module(get_local_internal_options): """Fixture to configure the local internal options file. It uses the test fixture get_local_internal_options. This should be @@ -145,7 +144,7 @@ def get_configuration(request): (['{level} GCP'.format(level=log_level) for log_level in log_levels]), ], indirect=True) def test_logging(get_configuration, configure_environment, reset_ossec_log, - publish_messages, configure_local_internal_options_package, + publish_messages, configure_local_internal_options_module, daemons_handler, wait_for_gcp_start): ''' description: Check if the 'gcp-pubsub' module generates logs according to the debug level set for wazuh_modules. @@ -167,7 +166,7 @@ def test_logging(get_configuration, configure_environment, reset_ossec_log, - publish_messages: type: list brief: List of testing GCP logs. - - configure_local_internal_options_package: + - configure_local_internal_options_module: type: fixture brief: Fixture to modify the local_internal_options.conf file and restart modulesd. diff --git a/tests/integration/test_gcloud/test_functionality/test_max_messages.py b/tests/integration/test_gcloud/test_functionality/test_max_messages.py index 5b9b539d33..5ca6ba1b2f 100644 --- a/tests/integration/test_gcloud/test_functionality/test_max_messages.py +++ b/tests/integration/test_gcloud/test_functionality/test_max_messages.py @@ -25,7 +25,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd @@ -62,6 +61,8 @@ from wazuh_testing.tools.configuration import load_wazuh_configurations from wazuh_testing.tools.monitoring import FileMonitor from wazuh_testing.tools.file import truncate_file +from wazuh_testing.tools import get_service + from google.cloud import pubsub_v1 # Marks @@ -82,7 +83,11 @@ # configurations -daemons_handler_configuration = {'daemons': ['wazuh-analysisd', 'wazuh-modulesd']} +if get_service() == 'wazuh-manager': + daemons_handler_configuration = {'daemons': ['wazuh-modulesd', 'wazuh-analysisd']} +else: + daemons_handler_configuration = {'daemons': ['wazuh-modulesd']} + monitoring_modes = ['scheduled'] conf_params = {'PROJECT_ID': global_parameters.gcp_project_id, 'SUBSCRIPTION_NAME': global_parameters.gcp_subscription_name, diff --git a/tests/integration/test_gcloud/test_functionality/test_pull_on_start.py b/tests/integration/test_gcloud/test_functionality/test_pull_on_start.py index dc7616bfb7..9175628aa6 100644 --- a/tests/integration/test_gcloud/test_functionality/test_pull_on_start.py +++ b/tests/integration/test_gcloud/test_functionality/test_pull_on_start.py @@ -24,7 +24,6 @@ - manager daemons: - - wazuh-analysisd - wazuh-monitord - wazuh-modulesd diff --git a/tests/integration/test_syscollector/data/configuration/configuration_syscollector.yaml b/tests/integration/test_syscollector/data/configuration/configuration_syscollector.yaml new file mode 100644 index 0000000000..74483c7f3a --- /dev/null +++ b/tests/integration/test_syscollector/data/configuration/configuration_syscollector.yaml @@ -0,0 +1,53 @@ +- sections: + - section: wodle + attributes: + - name: syscollector + elements: + - disabled: + value: DISABLED + - interval: + value: INVERVAL_SCAN + - scan_on_start: + value: START_ON_START + - hardware: + value: HARDWARE_SCAN + - os: + value: OS_SCAN + - network: + value: NETWORK_SCAN + - packages: + value: PACKAGES_SCAN + - ports: + value: PORTS_SCAN + attributes: + - all: ALL_PORTS + - processes: + value: PROCESSES_SCAN + - hotfixes: + value: HOTFIXES_SCAN + - synchronization: + elements: + - max_eps: + value: MAX_EPS + + - section: syscheck + elements: + - disabled: + value: 'yes' + + - section: wodle + attributes: + - name: vulnerability-detector + elements: + - disabled: + value: 'yes' + + - section: rootcheck + elements: + - disabled: + value: 'yes' + + - section: sca + elements: + - enabled: + value: 'no' diff --git a/tests/integration/test_syscollector/data/configuration/configuration_syscollector_no_tags.yaml b/tests/integration/test_syscollector/data/configuration/configuration_syscollector_no_tags.yaml new file mode 100644 index 0000000000..ee5b7cd584 --- /dev/null +++ b/tests/integration/test_syscollector/data/configuration/configuration_syscollector_no_tags.yaml @@ -0,0 +1,26 @@ +- sections: + - section: wodle + attributes: + - name: syscollector + + - section: syscheck + elements: + - disabled: + value: 'yes' + + - section: wodle + attributes: + - name: vulnerability-detector + elements: + - disabled: + value: 'yes' + + - section: rootcheck + elements: + - disabled: + value: 'yes' + + - section: sca + elements: + - enabled: + value: 'no' diff --git a/tests/integration/test_syscollector/data/configuration/configuration_syscollector_scans_disabled.yaml b/tests/integration/test_syscollector/data/configuration/configuration_syscollector_scans_disabled.yaml new file mode 100644 index 0000000000..7449c8c50a --- /dev/null +++ b/tests/integration/test_syscollector/data/configuration/configuration_syscollector_scans_disabled.yaml @@ -0,0 +1,49 @@ +- sections: + - section: wodle + attributes: + - name: syscollector + elements: + - disabled: + value: DISABLED + - interval: + value: INVERVAL_SCAN + - scan_on_start: + value: START_ON_START + - hardware: + value: HARDWARE_SCAN + - os: + value: OS_SCAN + - network: + value: NETWORK_SCAN + - packages: + value: PACKAGES_SCAN + - ports: + value: PORTS_SCAN + attributes: + - all: ALL_PORTS + - processes: + value: PROCESSES_SCAN + - hotfixes: + value: HOTFIXES_SCAN + + - section: syscheck + elements: + - disabled: + value: 'yes' + + - section: wodle + attributes: + - name: vulnerability-detector + elements: + - disabled: + value: 'yes' + + - section: rootcheck + elements: + - disabled: + value: 'yes' + + - section: sca + elements: + - enabled: + value: 'no' diff --git a/tests/integration/test_syscollector/data/test_cases/case_test_all_scans_disabled.yaml b/tests/integration/test_syscollector/data/test_cases/case_test_all_scans_disabled.yaml new file mode 100644 index 0000000000..caabe336a1 --- /dev/null +++ b/tests/integration/test_syscollector/data/test_cases/case_test_all_scans_disabled.yaml @@ -0,0 +1,26 @@ +- name: all_scans_disabled + description: Verify that the scan starts after N seconds but no scan is triggered + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 2s + START_ON_START: 'no' + HARDWARE_SCAN: 'no' + OS_SCAN: 'no' + NETWORK_SCAN: 'no' + PACKAGES_SCAN: 'no' + PORTS_SCAN: 'no' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'no' + HOTFIXES_SCAN: 'no' + metadata: + disabled: 'no' + interval_scan: 2 + start_on_start: 'no' + hardware_scan: 'no' + os_scan: 'no' + network_scan: 'no' + packages_scan: 'no' + ports_scan: 'no' + all_ports: 'no' + processes_scan: 'no' + hotfixes_scan: 'no' diff --git a/tests/integration/test_syscollector/data/test_cases/case_test_default_values.yaml b/tests/integration/test_syscollector/data/test_cases/case_test_default_values.yaml new file mode 100644 index 0000000000..4029fbb721 --- /dev/null +++ b/tests/integration/test_syscollector/data/test_cases/case_test_default_values.yaml @@ -0,0 +1,5 @@ +- name: check_default_values + description: Verify that the module starts using the default values + configuration_parameters: null + metadata: + default: null diff --git a/tests/integration/test_syscollector/data/test_cases/case_test_invalid_configurations.yaml b/tests/integration/test_syscollector/data/test_cases/case_test_invalid_configurations.yaml new file mode 100644 index 0000000000..3cd7161a78 --- /dev/null +++ b/tests/integration/test_syscollector/data/test_cases/case_test_invalid_configurations.yaml @@ -0,0 +1,436 @@ +- name: empty_value_disabled + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: '' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: disabled + attribute: null + +- name: empty_value_interval + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: '' + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: interval + attribute: null + +- name: empty_value_scan_on_start + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: '' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: scan_on_start + attribute: null + +- name: empty_value_hardware + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: '' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: hardware + attribute: null + +- name: empty_value_os + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: '' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: os + attribute: null + +- name: empty_value_network + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: '' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: network + attribute: null + +- name: empty_value_packages + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: '' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: packages + attribute: null + +- name: empty_value_ports + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: '' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: ports + attribute: null + +- name: empty_value_all_ports + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: '' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: null + attribute: all + +- name: empty_value_processes + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: '' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: processes + attribute: null + +- name: invalid_value_disabled + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: invalid + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: disabled + attribute: null + +- name: invalid_value_interval + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: invalid + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: interval + attribute: null + +- name: invalid_value_scan_on_start + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: invalid + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: scan_on_start + attribute: null + +- name: invalid_value_hardware + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: invalid + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: hardware + attribute: null + +- name: invalid_value_os + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: invalid + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: os + attribute: null + +- name: invalid_value_network + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: invalid + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: network + attribute: null + +- name: invalid_value_packages + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: invalid + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: packages + attribute: null + +- name: invalid_value_ports + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: invalid + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: ports + attribute: null + +- name: invalid_value_all_ports + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: invalid + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: null + attribute: all + +- name: invalid_value_processes + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: invalid + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + field: processes + attribute: null + +- name: invalid_value_max_eps + description: Verify that the module starts and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: -1 + metadata: + field: max_eps + attribute: null + +- name: empty_value_hotfixes + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: '' + MAX_EPS: 10 + metadata: + field: hotfixes + attribute: null + +- name: invalid_value_hotfixes + description: Verify that the module doesn't start and an error is displayed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: invalid + MAX_EPS: 10 + metadata: + field: hotfixes + attribute: null diff --git a/tests/integration/test_syscollector/data/test_cases/case_test_scanning.yaml b/tests/integration/test_syscollector/data/test_cases/case_test_scanning.yaml new file mode 100644 index 0000000000..76ee5decfc --- /dev/null +++ b/tests/integration/test_syscollector/data/test_cases/case_test_scanning.yaml @@ -0,0 +1,17 @@ +- name: check_syscollector_scan + description: Verify that the scan starts on startup and collects information but no sync is performed + configuration_parameters: + DISABLED: 'no' + INVERVAL_SCAN: 1h + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'yes' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + dummy_metadata: '' diff --git a/tests/integration/test_syscollector/data/test_cases/case_test_syscollector_deactivation.yaml b/tests/integration/test_syscollector/data/test_cases/case_test_syscollector_deactivation.yaml new file mode 100644 index 0000000000..ff18ec8ed2 --- /dev/null +++ b/tests/integration/test_syscollector/data/test_cases/case_test_syscollector_deactivation.yaml @@ -0,0 +1,28 @@ +- name: check_syscollector_deactivation + description: Verify that the module does not start when it's disabled + configuration_parameters: + DISABLED: 'yes' + INVERVAL_SCAN: 5s + START_ON_START: 'yes' + HARDWARE_SCAN: 'yes' + OS_SCAN: 'yes' + NETWORK_SCAN: 'yes' + PACKAGES_SCAN: 'yes' + PORTS_SCAN: 'yes' + ALL_PORTS: 'no' + PROCESSES_SCAN: 'yes' + HOTFIXES_SCAN: 'yes' + MAX_EPS: 10 + metadata: + disabled: 'yes' + interval_scan: 5 + start_on_start: 'yes' + hardware_scan: 'yes' + os_scan: 'yes' + network_scan: 'yes' + packages_scan: 'yes' + ports_scan: 'yes' + all_ports: 'no' + processes_scan: 'yes' + hotfixes_scan: 'yes' + max_eps: 10 diff --git a/tests/integration/test_syscollector/test_syscollector_configuration.py b/tests/integration/test_syscollector/test_syscollector_configuration.py new file mode 100644 index 0000000000..fe1224df06 --- /dev/null +++ b/tests/integration/test_syscollector/test_syscollector_configuration.py @@ -0,0 +1,446 @@ +''' +copyright: Copyright (C) 2015-2023, Wazuh Inc. + + Created by Wazuh, Inc. . + + This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 + +type: integration + +brief: Wazuh gathers information about the agent system (OS, hardware, packages, etc.) periodically in a DB and sends + it to the manager, which finally stores this information in a DB. These tests check the different syscollector + configurations and the complete scan process. + +components: + - modulesd + +suite: syscollector + +targets: + - manager + - agent + +daemons: + - wazuh-modulesd + - wazuh-analysisd + - wazuh-db + +os_platform: + - linux + - windows + - macos + +os_version: + - CentOS 8 + - Ubuntu Bionic + - macOS Catalina + - Windows Server 2016 + - Windows Server 2019 + +references: + - https://documentation.wazuh.com/current/user-manual/capabilities/syscollector.html + - https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/wodle-syscollector.html +''' +import os +import sys + +import pytest +from wazuh_testing import ANALYSISD_DAEMON, DB_DAEMON, MODULES_DAEMON, LOG_FILE_PATH, T_10, T_60 +from wazuh_testing.modules import TIER0, SERVER, AGENT, LINUX, MACOS, WINDOWS +from wazuh_testing.tools import get_service +from wazuh_testing.tools.configuration import load_configuration_template, get_test_cases_data +from wazuh_testing.tools.monitoring import FileMonitor +from wazuh_testing.modules.syscollector import event_monitor as evm + + +# Marks +pytestmark = [TIER0, SERVER, AGENT, LINUX, MACOS, WINDOWS] + +# Reference paths +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, 'configuration') +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, 'test_cases') + +# Variables +local_internal_options = {'wazuh_modules.debug': 2} +if get_service() == 'wazuh-manager': + daemons_handler_configuration = {'daemons': [ANALYSISD_DAEMON, DB_DAEMON, MODULES_DAEMON], 'ignore_errors': True} +elif sys.platform == 'win32': + daemons_handler_configuration = {'all_daemons': True, 'ignore_errors': True} + local_internal_options = {'windows.debug': 2} +else: + daemons_handler_configuration = {'daemons': [MODULES_DAEMON], 'ignore_errors': True} + +# T1 Parameters: Check that Syscollector is disabled. +t1_config_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_syscollector.yaml') +t1_cases_path = os.path.join(TEST_CASES_PATH, 'case_test_syscollector_deactivation.yaml') +t1_config_parameters, t1_config_metadata, t1_case_ids = get_test_cases_data(t1_cases_path) +t1_configurations = load_configuration_template(t1_config_path, t1_config_parameters, t1_config_metadata) + +# T2 Parameters: Check that each scan is disabled. +t2_config_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_syscollector_scans_disabled.yaml') +t2_cases_path = os.path.join(TEST_CASES_PATH, 'case_test_all_scans_disabled.yaml') +t2_config_parameters, t2_config_metadata, t2_case_ids = get_test_cases_data(t2_cases_path) +t2_configurations = load_configuration_template(t2_config_path, t2_config_parameters, t2_config_metadata) + +# T3 Parameters: Check the behavior of Syscollector while setting invalid configurations. +t3_config_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_syscollector.yaml') +t3_cases_path = os.path.join(TEST_CASES_PATH, 'case_test_invalid_configurations.yaml') +t3_config_parameters, t3_config_metadata, t3_case_ids = get_test_cases_data(t3_cases_path) +t3_configurations = load_configuration_template(t3_config_path, t3_config_parameters, t3_config_metadata) + +# T4 Parameters: Check that Syscollector sets the default values when the configuration block is empty. +t4_config_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_syscollector_no_tags.yaml') +t4_cases_path = os.path.join(TEST_CASES_PATH, 'case_test_default_values.yaml') +t4_config_parameters, t4_config_metadata, t4_case_ids = get_test_cases_data(t4_cases_path) +t4_configurations = load_configuration_template(t4_config_path, t4_config_parameters, t4_config_metadata) + +# T5 Parameters: Check that the scan is completed when all scans are enabled. +t5_config_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_syscollector.yaml') +t5_cases_path = os.path.join(TEST_CASES_PATH, 'case_test_scanning.yaml') +t5_config_parameters, t5_config_metadata, t5_case_ids = get_test_cases_data(t5_cases_path) +t5_config_metadata = t5_config_parameters +t5_configurations = load_configuration_template(t5_config_path, t5_config_parameters, t5_config_metadata) + + +# Tests +@pytest.mark.parametrize('configuration, metadata', zip(t1_configurations, t1_config_metadata), ids=t1_case_ids) +def test_syscollector_deactivation(configuration, metadata, set_wazuh_configuration, + configure_local_internal_options_module, truncate_monitored_files, + daemons_handler_function): + ''' + description: Check that syscollector is disabled. + + test_phases: + - setup: + - Set Syscollector configuration. + - Configure modulesd in debug mode. + - Truncate all the log files and json alerts files. + - Restart the necessary daemons for each test case. + - test: + - Check if Syscollector was disabled. + - teardown: + - Restore Wazuh configuration. + - Restore local internal options. + - Truncate all the log files and json alerts files. + - Stop the necessary daemons. + + wazuh_min_version: 4.4.0 + + tier: 0 + + parameters: + - configuration: + type: dict + brief: Configuration loaded from the template located in `configuration` folder. + - metadata: + type: dict + brief: Test case metadata. + - set_wazuh_configuration: + type: fixture + brief: Set wazuh configuration using the configuration template. + - configure_local_internal_options_module: + type: fixture + brief: Configure the local internal options file. + - truncate_monitored_files: + type: fixture + brief: Truncate all the log files and json alerts files before and after the test execution. + - daemons_handler_function: + type: fixture + brief: Handler of Wazuh daemons for each test case. + + assertions: + - Check if the syscollector module is disabled. + + input_description: + - The `configuration_syscollector.yaml` file provides the module configuration for this test. + - The `case_test_syscollector_deactivation.yaml` file provides the test cases. + ''' + file_monitor = FileMonitor(LOG_FILE_PATH) + evm.check_syscollector_is_disabled(file_monitor=file_monitor, timeout=T_10) + + +@pytest.mark.parametrize('configuration, metadata', zip(t2_configurations, t2_config_metadata), ids=t2_case_ids) +def test_syscollector_all_scans_disabled(configuration, metadata, set_wazuh_configuration, + configure_local_internal_options_module, truncate_monitored_files, + daemons_handler_function): + ''' + description: Check that each scan is disabled. + + test_phases: + - setup: + - Set Syscollector configuration. + - Configure modulesd in debug mode. + - Truncate all the log files and json alerts files. + - Restart the necessary daemons for each test case. + - test: + - Check that no scan is triggered. + - teardown: + - Restore Wazuh configuration. + - Restore local internal options. + - Truncate all the log files and json alerts files. + - Stop the necessary daemons. + + wazuh_min_version: 4.4.0 + + tier: 0 + + parameters: + - configuration: + type: dict + brief: Configuration loaded from the template located in `configuration` folder. + - metadata: + type: dict + brief: Test case metadata. + - set_wazuh_configuration: + type: fixture + brief: Set wazuh configuration using the configuration template. + - configure_local_internal_options_module: + type: fixture + brief: Configure the local internal options file. + - truncate_monitored_files: + type: fixture + brief: Truncate the log file before and after the test execution. + - daemons_handler_function: + type: fixture + brief: Handler of Wazuh daemons for each test case. + + assertions: + - Check if a specific scan is disabled and not triggered. + + input_description: + - The `configuration_syscollector_scans_disabled.yaml` file provides the module configuration for this test. + - The `case_test_all_scans_disabled.yaml` file provides the test cases. + ''' + check_functions = [evm.check_hardware_scan_started, evm.check_os_scan_started, evm.check_network_scan_started, + evm.check_packages_scan_started, evm.check_ports_scan_started, evm.check_processes_scan_started] + # Add the hotfixes check if the platform is Windows. + if sys.platform == 'win32': + check_functions.append(evm.check_hotfixes_scan_started) + + # Check that no scan is triggered. + for check_function in check_functions: + # Expected: the function must throw a TimeoutError + with pytest.raises(TimeoutError): + file_monitor = FileMonitor(LOG_FILE_PATH) + # Is not necessary to set the update_position to False because the Syscollector is configured to run its + # scan every 2 seconds in `case_test_all_scans_disabled.yaml` + check_function(file_monitor=file_monitor) + pytest.fail('It seems that a scan was triggered.' + f"This check has a match in the log: {check_function.__name__}") + + +@pytest.mark.parametrize('configuration, metadata', zip(t3_configurations, t3_config_metadata), ids=t3_case_ids) +def test_syscollector_invalid_configurations(configuration, metadata, set_wazuh_configuration, + configure_local_internal_options_module, truncate_monitored_files, + daemons_handler_function): + ''' + description: Check the behavior of Syscollector while setting invalid configurations. + + test_phases: + - setup: + - Set Syscollector configuration. + - Configure modulesd in debug mode. + - Truncate all the log files and json alerts files. + - Restart the necessary daemons for each test case. + - test: + - Skip test if the field is hotfixes and the platform is not Windows. + - Check if the tag/attribute error is present in the logs. + - Check if Syscollector starts depending on the criticality of the field. + - teardown: + - Restore Wazuh configuration. + - Restore local internal options. + - Truncate all the log files and json alerts files. + - Stop the necessary daemons. + + wazuh_min_version: 4.4.0 + + tier: 0 + + parameters: + - configuration: + type: dict + brief: Configuration loaded from the template located in `configuration` folder. + - metadata: + type: dict + brief: Test case metadata. + - set_wazuh_configuration: + type: fixture + brief: Set wazuh configuration using the configuration template. + - configure_local_internal_options_module: + type: fixture + brief: Configure the local internal options file. + - truncate_monitored_files: + type: fixture + brief: Truncate the log file before and after the test execution. + - daemons_handler_function: + type: fixture + brief: Handler of Wazuh daemons for each test case. + + assertions: + - Check if the scan is triggered after N seconds. + - Check if a specific scan is disabled and not triggered. + + input_description: + - The `configuration_syscollector.yaml` file provides the module configuration for this test. + - The `case_test_invalid_configurations.yaml` file provides the test cases. + ''' + field = metadata['field'] + attribute = metadata['attribute'] + non_critical_fields = ('max_eps') + file_monitor = FileMonitor(LOG_FILE_PATH) + + # Skip test if the field is hotfixes and the platform is not Windows. + if field == 'hotfixes' and sys.platform != 'win32': + pytest.skip('The hotfixes scan is exclusive of Windows agents.') + + # If the field has no value, it means that the test should search for the attribute error in the logs, not for the + # tag error. + if field is not None: + evm.check_tag_error(file_monitor=file_monitor, field=field) + # Check that the module has started if the field is not critical + if field in non_critical_fields: + file_monitor = FileMonitor(LOG_FILE_PATH) + evm.check_module_is_starting(file_monitor=file_monitor) + else: + evm.check_attr_error(file_monitor=file_monitor, attr=attribute) + + # Check that the module does not start if the field is critical + with pytest.raises(TimeoutError): + evm.check_module_is_starting(file_monitor=file_monitor) + pytest.fail(f"The module has started anyway. This behavior is not the expected.") + + +@pytest.mark.parametrize('configuration, metadata', zip(t4_configurations, t4_config_metadata), ids=t4_case_ids) +@pytest.mark.xfail(reason='Reported in wazuh/wazuh#15413 - To be removed in 4.5: wazuh/wazuh-qa#3798') +def test_syscollector_default_values(configuration, metadata, set_wazuh_configuration, + configure_local_internal_options_module, truncate_monitored_files, + daemons_handler_function): + ''' + description: Check that Syscollector sets the default values when the configuration block is empty. + + test_phases: + - setup: + - Set Syscollector configuration. + - Configure modulesd in debug mode. + - Truncate all the log files and json alerts files. + - Restart the necessary daemons for each test case. + - test: + - Check if the default configuration was applied. + - Check if Syscollector starts correctly. + - teardown: + - Restore Wazuh configuration. + - Restore local internal options. + - Truncate all the log files and json alerts files. + - Stop the necessary daemons. + + wazuh_min_version: 4.4.0 + + tier: 0 + + parameters: + - configuration: + type: dict + brief: Configuration loaded from the template located in `configuration` folder. + - metadata: + type: dict + brief: Test case metadata. + - set_wazuh_configuration: + type: fixture + brief: Set wazuh configuration using the configuration template. + - configure_local_internal_options_module: + type: fixture + brief: Configure the local internal options file. + - truncate_monitored_files: + type: fixture + brief: Truncate the log file before and after the test execution. + - daemons_handler_function: + type: fixture + brief: Handler of Wazuh daemons for each test case. + + assertions: + - Check if the module sets the default configuration. + + input_description: + - The `configuration_syscollector_no_tags.yaml` file provides the module configuration for this test. + - The `case_test_default_values.yaml` file provides the test cases. + ''' + file_monitor = FileMonitor(LOG_FILE_PATH) + evm.check_config(file_monitor=file_monitor) + evm.check_module_startup_finished(file_monitor=file_monitor) + + +@pytest.mark.parametrize('configuration, metadata', zip(t5_configurations, t5_config_metadata), ids=t5_case_ids) +def test_syscollector_scanning(configuration, metadata, set_wazuh_configuration, + configure_local_internal_options_module, truncate_monitored_files, + daemons_handler_function): + ''' + description: Check that the scan is completed when all scans are enabled. + + test_phases: + - setup: + - Set Syscollector configuration. + - Configure modulesd in debug mode. + - Truncate all the log files and json alerts files. + - Restart the necessary daemons for each test case. + - test: + - Check if the default configuration was applied. + - Check if Syscollector starts correctly. + - teardown: + - Restore Wazuh configuration. + - Restore local internal options. + - Truncate all the log files and json alerts files. + - Stop the necessary daemons. + + wazuh_min_version: 4.4.0 + + tier: 0 + + parameters: + - configuration: + type: dict + brief: Configuration loaded from the template located in `configuration` folder. + - metadata: + type: dict + brief: Test case metadata. + - set_wazuh_configuration: + type: fixture + brief: Set wazuh configuration using the configuration template. + - configure_local_internal_options_module: + type: fixture + brief: Configure the local internal options file. + - truncate_monitored_files: + type: fixture + brief: Truncate the log file before and after the test execution. + - daemons_handler_function: + type: fixture + brief: Handler of Wazuh daemons for each test case. + + assertions: + - Check if each scan is completed. + - Check if the synchronization is completed. + + input_description: + - The `configuration_syscollector.yaml` file provides the module configuration for this test. + - The `case_test_scanning.yaml` file provides the test cases. + ''' + file_monitor = FileMonitor(LOG_FILE_PATH) + # 60s + 2 seconds of margin because it includes the case when the agent starts for the first time + evm.check_module_is_starting(file_monitor=file_monitor, timeout=T_60 + 2) + # Check general scan has started + evm.check_scan_started(file_monitor=file_monitor, timeout=T_10) + + # Check that each scan was accomplished + checks_to_run = [evm.check_hardware_scan_finished, evm.check_os_scan_finished, evm.check_network_scan_finished, + evm.check_packages_scan_finished, evm.check_ports_scan_finished, evm.check_processes_scan_finished] + if sys.platform == 'win32': + checks_to_run.append(evm.check_hotfixes_scan_finished) + + for check_runner in checks_to_run: + # Run check + check_runner(file_monitor=file_monitor, timeout=T_10) + + # Check general scan has finished + evm.check_scan_finished(file_monitor=file_monitor, timeout=T_10) + # Check that the sync has finished + evm.check_sync_finished(file_monitor=file_monitor, timeout=T_10) diff --git a/tests/integration/test_wazuh_db/data/global/set_agent_groups.yaml b/tests/integration/test_wazuh_db/data/global/set_agent_groups.yaml index 22b8c84297..368592bb08 100644 --- a/tests/integration/test_wazuh_db/data/global/set_agent_groups.yaml +++ b/tests/integration/test_wazuh_db/data/global/set_agent_groups.yaml @@ -281,7 +281,7 @@ output: err An error occurred during the set of the groups agent_id: 27 expected_group: None - expected_warint: ".*WARNING: Invalid group name. 'Test,Group1' contains invalid characters" + expected_warning: ".*WARNING: Invalid group name. 'Test,Group1' contains invalid characters" expected_group_sync_status: synced - name: Wrong group name format - Assign a group with an invalid group name (has invalid '@' character) - Warning @@ -301,7 +301,7 @@ output: err An error occurred during the set of the groups agent_id: 29 expected_group: None - expected_warint: ".*WARNING: Invalid group name. '.' represents the current directory in unix systems" + expected_warning: ".*WARNING: Invalid group name. '.' represents the current directory in unix systems" expected_group_sync_status: synced - name: Wrong group name format - Assign a group with an invalid group name (..) - Warning diff --git a/tests/integration/test_wazuh_db/test_agent_database_version.py b/tests/integration/test_wazuh_db/test_agent_database_version.py index 41d773ec0c..9a0e9a4512 100644 --- a/tests/integration/test_wazuh_db/test_agent_database_version.py +++ b/tests/integration/test_wazuh_db/test_agent_database_version.py @@ -63,3 +63,6 @@ def test_agent_database_version(restart_wazuh_daemon, remove_agents): assert agent_version == expected_database_version, 'The agent database version is not the expected one. \n' \ f'Expected version: {expected_database_version}\n'\ f'Obtained version: {agent_version}' + + for agent in agents: + agent.stop_receiver() From a474f439ba7b60f0e0e39524e7d0572607ac7599 Mon Sep 17 00:00:00 2001 From: Kevin Ledesma Date: Thu, 11 May 2023 05:11:10 -0300 Subject: [PATCH 29/34] fix(#4112): update syscheck registry win32 cases * fix(#4112): update syscheck registry win32 cases * docs(#4112): update CHANGELOG --- CHANGELOG.md | 1 + .../data/syscheck_registry_events_win32.yaml | 40508 ++++++++-------- 2 files changed, 20255 insertions(+), 20254 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9bdd11611a..3dcbc63636 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -34,6 +34,7 @@ All notable changes to this project will be documented in this file. ### Fixed +- Fix cases yaml of the analysisd windows registry IT ([#4149](https://github.com/wazuh/wazuh-qa/pull/4149)) \- (Tests) - Fix a bug in on Migration tool's library ([#4106](https://github.com/wazuh/wazuh-qa/pull/4106)) \- (Framework) - Fix imports and add windows support for test_report_changes_and_diff IT ([#3548](https://github.com/wazuh/wazuh-qa/issues/3548)) \- (Framework + Tests) - Fix a regex error in the FIM integration tests ([#3061](https://github.com/wazuh/wazuh-qa/issues/3061)) \- (Framework + Tests) diff --git a/tests/integration/test_analysisd/test_all_syscheckd_configurations/data/syscheck_registry_events_win32.yaml b/tests/integration/test_analysisd/test_all_syscheckd_configurations/data/syscheck_registry_events_win32.yaml index 1eb70012cf..55ba962564 100644 --- a/tests/integration/test_analysisd/test_all_syscheckd_configurations/data/syscheck_registry_events_win32.yaml +++ b/tests/integration/test_analysisd/test_all_syscheckd_configurations/data/syscheck_registry_events_win32.yaml @@ -1,7 +1,7 @@ --- - name: Added0 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17,7 +17,7 @@ stage: Added - name: Added1 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -26,7 +26,7 @@ stage: Added - name: Modified2 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46,7 +46,7 @@ stage: Modified - name: Added3 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62,7 +62,7 @@ stage: Added - name: Added4 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -71,7 +71,7 @@ stage: Added - name: Modified5 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91,7 +91,7 @@ stage: Modified - name: Added6 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107,7 +107,7 @@ stage: Added - name: Added7 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -116,7 +116,7 @@ stage: Added - name: Modified8 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136,7 +136,7 @@ stage: Modified - name: Added9 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152,7 +152,7 @@ stage: Added - name: Added10 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -161,7 +161,7 @@ stage: Added - name: Modified11 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181,7 +181,7 @@ stage: Modified - name: Added12 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197,7 +197,7 @@ stage: Added - name: Added13 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -206,7 +206,7 @@ stage: Added - name: Modified14 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226,7 +226,7 @@ stage: Modified - name: Added15 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -242,7 +242,7 @@ stage: Added - name: Added16 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -251,7 +251,7 @@ stage: Added - name: Modified17 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -271,7 +271,7 @@ stage: Modified - name: Added18 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -287,7 +287,7 @@ stage: Added - name: Added19 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -296,7 +296,7 @@ stage: Added - name: Modified20 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -316,7 +316,7 @@ stage: Modified - name: Added21 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -332,7 +332,7 @@ stage: Added - name: Added22 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -341,7 +341,7 @@ stage: Added - name: Modified23 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -361,7 +361,7 @@ stage: Modified - name: Added24 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -377,7 +377,7 @@ stage: Added - name: Added25 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -386,7 +386,7 @@ stage: Added - name: Added26 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -402,7 +402,7 @@ stage: Added - name: Added27 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -411,7 +411,7 @@ stage: Added - name: Added28 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -427,7 +427,7 @@ stage: Added - name: Added29 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -436,7 +436,7 @@ stage: Added - name: Added30 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -452,7 +452,7 @@ stage: Added - name: Added31 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -461,7 +461,7 @@ stage: Added - name: Added32 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -477,7 +477,7 @@ stage: Added - name: Added33 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -486,7 +486,7 @@ stage: Added - name: Added34 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -502,7 +502,7 @@ stage: Added - name: Added35 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -511,7 +511,7 @@ stage: Added - name: Added36 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769867,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -527,7 +527,7 @@ stage: Added - name: Added37 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769867,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769867, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -536,7 +536,7 @@ stage: Added - name: Added38 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -552,7 +552,7 @@ stage: Added - name: Added39 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -561,7 +561,7 @@ stage: Added - name: Added40 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -569,7 +569,7 @@ stage: Added - name: Added41 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -578,7 +578,7 @@ stage: Added - name: Modified42 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -586,7 +586,7 @@ stage: Modified - name: Added43 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -594,7 +594,7 @@ stage: Added - name: Added44 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -603,7 +603,7 @@ stage: Added - name: Modified45 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -611,7 +611,7 @@ stage: Modified - name: Added46 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -619,7 +619,7 @@ stage: Added - name: Added47 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -628,7 +628,7 @@ stage: Added - name: Modified48 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -636,7 +636,7 @@ stage: Modified - name: Added49 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -644,7 +644,7 @@ stage: Added - name: Added50 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -653,7 +653,7 @@ stage: Added - name: Modified51 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -661,7 +661,7 @@ stage: Modified - name: Added52 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -669,7 +669,7 @@ stage: Added - name: Added53 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -678,7 +678,7 @@ stage: Added - name: Modified54 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -686,7 +686,7 @@ stage: Modified - name: Added55 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -694,7 +694,7 @@ stage: Added - name: Added56 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -703,7 +703,7 @@ stage: Added - name: Modified57 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -711,7 +711,7 @@ stage: Modified - name: Added58 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -719,7 +719,7 @@ stage: Added - name: Added59 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -728,7 +728,7 @@ stage: Added - name: Modified60 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -736,7 +736,7 @@ stage: Modified - name: Added61 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -744,7 +744,7 @@ stage: Added - name: Added62 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -753,7 +753,7 @@ stage: Added - name: Modified63 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -761,7 +761,7 @@ stage: Modified - name: Added64 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -769,7 +769,7 @@ stage: Added - name: Added65 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -778,7 +778,7 @@ stage: Added - name: Added66 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -786,7 +786,7 @@ stage: Added - name: Added67 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -795,7 +795,7 @@ stage: Added - name: Added68 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -803,7 +803,7 @@ stage: Added - name: Added69 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -812,7 +812,7 @@ stage: Added - name: Added70 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -820,7 +820,7 @@ stage: Added - name: Added71 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -829,7 +829,7 @@ stage: Added - name: Added72 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -837,7 +837,7 @@ stage: Added - name: Added73 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -846,7 +846,7 @@ stage: Added - name: Added74 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -854,7 +854,7 @@ stage: Added - name: Added75 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -863,7 +863,7 @@ stage: Added - name: Added76 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -871,7 +871,7 @@ stage: Added - name: Added77 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -880,7 +880,7 @@ stage: Added - name: Added78 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -888,7 +888,7 @@ stage: Added - name: Added79 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -897,7 +897,7 @@ stage: Added - name: Added80 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -913,7 +913,7 @@ stage: Added - name: Added81 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -922,7 +922,7 @@ stage: Added - name: Modified82 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -942,7 +942,7 @@ stage: Modified - name: Added83 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -958,7 +958,7 @@ stage: Added - name: Added84 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -967,7 +967,7 @@ stage: Added - name: Modified85 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -987,7 +987,7 @@ stage: Modified - name: Added86 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1003,7 +1003,7 @@ stage: Added - name: Added87 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1012,7 +1012,7 @@ stage: Added - name: Modified88 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1032,7 +1032,7 @@ stage: Modified - name: Added89 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1048,7 +1048,7 @@ stage: Added - name: Added90 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1057,7 +1057,7 @@ stage: Added - name: Modified91 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1077,7 +1077,7 @@ stage: Modified - name: Added92 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1093,7 +1093,7 @@ stage: Added - name: Added93 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1102,7 +1102,7 @@ stage: Added - name: Modified94 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1122,7 +1122,7 @@ stage: Modified - name: Added95 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1138,7 +1138,7 @@ stage: Added - name: Added96 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1147,7 +1147,7 @@ stage: Added - name: Modified97 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1167,7 +1167,7 @@ stage: Modified - name: Added98 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1183,7 +1183,7 @@ stage: Added - name: Added99 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1192,7 +1192,7 @@ stage: Added - name: Modified100 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1212,7 +1212,7 @@ stage: Modified - name: Added101 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1228,7 +1228,7 @@ stage: Added - name: Added102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1237,7 +1237,7 @@ stage: Added - name: Modified103 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1257,7 +1257,7 @@ stage: Modified - name: Added104 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1272,7 +1272,7 @@ stage: Added - name: Added105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1281,7 +1281,7 @@ stage: Added - name: Added106 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1296,7 +1296,7 @@ stage: Added - name: Added107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1305,7 +1305,7 @@ stage: Added - name: Added108 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1320,7 +1320,7 @@ stage: Added - name: Added109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1329,7 +1329,7 @@ stage: Added - name: Added110 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1344,7 +1344,7 @@ stage: Added - name: Added111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1353,7 +1353,7 @@ stage: Added - name: Added112 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1368,7 +1368,7 @@ stage: Added - name: Added113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1377,7 +1377,7 @@ stage: Added - name: Added114 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1392,7 +1392,7 @@ stage: Added - name: Added115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1401,7 +1401,7 @@ stage: Added - name: Added116 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1416,7 +1416,7 @@ stage: Added - name: Added117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1425,7 +1425,7 @@ stage: Added - name: Added118 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1440,7 +1440,7 @@ stage: Added - name: Added119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1449,7 +1449,7 @@ stage: Added - name: Added120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1457,7 +1457,7 @@ stage: Added - name: Added121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1466,7 +1466,7 @@ stage: Added - name: Modified122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1474,7 +1474,7 @@ stage: Modified - name: Added123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1482,7 +1482,7 @@ stage: Added - name: Added124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1491,7 +1491,7 @@ stage: Added - name: Modified125 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1499,7 +1499,7 @@ stage: Modified - name: Added126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1507,7 +1507,7 @@ stage: Added - name: Added127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1516,7 +1516,7 @@ stage: Added - name: Modified128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1524,7 +1524,7 @@ stage: Modified - name: Added129 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1532,7 +1532,7 @@ stage: Added - name: Added130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1541,7 +1541,7 @@ stage: Added - name: Modified131 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1549,7 +1549,7 @@ stage: Modified - name: Added132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1557,7 +1557,7 @@ stage: Added - name: Added133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1566,7 +1566,7 @@ stage: Added - name: Modified134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1574,7 +1574,7 @@ stage: Modified - name: Added135 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1582,7 +1582,7 @@ stage: Added - name: Added136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1591,7 +1591,7 @@ stage: Added - name: Modified137 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1599,7 +1599,7 @@ stage: Modified - name: Added138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1607,7 +1607,7 @@ stage: Added - name: Added139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1616,7 +1616,7 @@ stage: Added - name: Modified140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1624,7 +1624,7 @@ stage: Modified - name: Added141 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1632,7 +1632,7 @@ stage: Added - name: Added142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1641,7 +1641,7 @@ stage: Added - name: Modified143 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723043, @@ -1649,14 +1649,14 @@ stage: Modified - name: Added144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1665,14 +1665,14 @@ stage: Added - name: Added146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1681,14 +1681,14 @@ stage: Added - name: Added148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1697,14 +1697,14 @@ stage: Added - name: Added150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1713,14 +1713,14 @@ stage: Added - name: Added152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1729,14 +1729,14 @@ stage: Added - name: Added154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1745,14 +1745,14 @@ stage: Added - name: Added156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1761,14 +1761,14 @@ stage: Added - name: Added158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1777,7 +1777,7 @@ stage: Added - name: Added160 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1793,7 +1793,7 @@ stage: Added - name: Added161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1802,7 +1802,7 @@ stage: Added - name: Modified162 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1822,7 +1822,7 @@ stage: Modified - name: Added163 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1838,7 +1838,7 @@ stage: Added - name: Added164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1847,7 +1847,7 @@ stage: Added - name: Modified165 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1867,7 +1867,7 @@ stage: Modified - name: Added166 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1883,7 +1883,7 @@ stage: Added - name: Added167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1892,7 +1892,7 @@ stage: Added - name: Modified168 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1912,7 +1912,7 @@ stage: Modified - name: Added169 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1928,7 +1928,7 @@ stage: Added - name: Added170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1937,7 +1937,7 @@ stage: Added - name: Modified171 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1957,7 +1957,7 @@ stage: Modified - name: Added172 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -1973,7 +1973,7 @@ stage: Added - name: Added173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -1982,7 +1982,7 @@ stage: Added - name: Modified174 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2002,7 +2002,7 @@ stage: Modified - name: Added175 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2018,7 +2018,7 @@ stage: Added - name: Added176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2027,7 +2027,7 @@ stage: Added - name: Modified177 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2047,7 +2047,7 @@ stage: Modified - name: Added178 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2063,7 +2063,7 @@ stage: Added - name: Added179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2072,7 +2072,7 @@ stage: Added - name: Modified180 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2092,7 +2092,7 @@ stage: Modified - name: Added181 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2108,7 +2108,7 @@ stage: Added - name: Added182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2117,7 +2117,7 @@ stage: Added - name: Modified183 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2137,7 +2137,7 @@ stage: Modified - name: Added184 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2153,7 +2153,7 @@ stage: Added - name: Added185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2162,7 +2162,7 @@ stage: Added - name: Added186 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2178,7 +2178,7 @@ stage: Added - name: Added187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2187,7 +2187,7 @@ stage: Added - name: Added188 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2203,7 +2203,7 @@ stage: Added - name: Added189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2212,7 +2212,7 @@ stage: Added - name: Added190 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2228,7 +2228,7 @@ stage: Added - name: Added191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2237,7 +2237,7 @@ stage: Added - name: Added192 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2253,7 +2253,7 @@ stage: Added - name: Added193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2262,7 +2262,7 @@ stage: Added - name: Added194 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2278,7 +2278,7 @@ stage: Added - name: Added195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2287,7 +2287,7 @@ stage: Added - name: Added196 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2303,7 +2303,7 @@ stage: Added - name: Added197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2312,7 +2312,7 @@ stage: Added - name: Added198 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2328,7 +2328,7 @@ stage: Added - name: Added199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2337,7 +2337,7 @@ stage: Added - name: Added200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2345,7 +2345,7 @@ stage: Added - name: Added201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2354,7 +2354,7 @@ stage: Added - name: Modified202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2362,7 +2362,7 @@ stage: Modified - name: Added203 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2370,7 +2370,7 @@ stage: Added - name: Added204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2379,7 +2379,7 @@ stage: Added - name: Modified205 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2387,7 +2387,7 @@ stage: Modified - name: Added206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2395,7 +2395,7 @@ stage: Added - name: Added207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2404,7 +2404,7 @@ stage: Added - name: Modified208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2412,7 +2412,7 @@ stage: Modified - name: Added209 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2420,7 +2420,7 @@ stage: Added - name: Added210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2429,7 +2429,7 @@ stage: Added - name: Modified211 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2437,7 +2437,7 @@ stage: Modified - name: Added212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2445,7 +2445,7 @@ stage: Added - name: Added213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2454,7 +2454,7 @@ stage: Added - name: Modified214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2462,7 +2462,7 @@ stage: Modified - name: Added215 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2470,7 +2470,7 @@ stage: Added - name: Added216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2479,7 +2479,7 @@ stage: Added - name: Modified217 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2487,7 +2487,7 @@ stage: Modified - name: Added218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2495,7 +2495,7 @@ stage: Added - name: Added219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2504,7 +2504,7 @@ stage: Added - name: Modified220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2512,7 +2512,7 @@ stage: Modified - name: Added221 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2520,7 +2520,7 @@ stage: Added - name: Added222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2529,7 +2529,7 @@ stage: Added - name: Modified223 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -2537,7 +2537,7 @@ stage: Modified - name: Added224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -2545,7 +2545,7 @@ stage: Added - name: Added225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2554,7 +2554,7 @@ stage: Added - name: Added226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -2562,7 +2562,7 @@ stage: Added - name: Added227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2571,7 +2571,7 @@ stage: Added - name: Added228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -2579,7 +2579,7 @@ stage: Added - name: Added229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2588,7 +2588,7 @@ stage: Added - name: Added230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -2596,7 +2596,7 @@ stage: Added - name: Added231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2605,7 +2605,7 @@ stage: Added - name: Added232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -2613,7 +2613,7 @@ stage: Added - name: Added233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2622,7 +2622,7 @@ stage: Added - name: Added234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -2630,7 +2630,7 @@ stage: Added - name: Added235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2639,7 +2639,7 @@ stage: Added - name: Added236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -2647,7 +2647,7 @@ stage: Added - name: Added237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2656,7 +2656,7 @@ stage: Added - name: Added238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -2664,7 +2664,7 @@ stage: Added - name: Added239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2673,7 +2673,7 @@ stage: Added - name: Added240 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2688,7 +2688,7 @@ stage: Added - name: Added241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2697,7 +2697,7 @@ stage: Added - name: Modified242 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2716,7 +2716,7 @@ stage: Modified - name: Added243 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2731,7 +2731,7 @@ stage: Added - name: Added244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2740,7 +2740,7 @@ stage: Added - name: Modified245 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2759,7 +2759,7 @@ stage: Modified - name: Added246 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2774,7 +2774,7 @@ stage: Added - name: Added247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2783,7 +2783,7 @@ stage: Added - name: Modified248 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2802,7 +2802,7 @@ stage: Modified - name: Added249 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2817,7 +2817,7 @@ stage: Added - name: Added250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2826,7 +2826,7 @@ stage: Added - name: Modified251 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2845,7 +2845,7 @@ stage: Modified - name: Added252 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2860,7 +2860,7 @@ stage: Added - name: Added253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2869,7 +2869,7 @@ stage: Added - name: Modified254 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2888,7 +2888,7 @@ stage: Modified - name: Added255 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2903,7 +2903,7 @@ stage: Added - name: Added256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2912,7 +2912,7 @@ stage: Added - name: Modified257 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2931,7 +2931,7 @@ stage: Modified - name: Added258 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2946,7 +2946,7 @@ stage: Added - name: Added259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2955,7 +2955,7 @@ stage: Added - name: Modified260 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2974,7 +2974,7 @@ stage: Modified - name: Added261 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -2989,7 +2989,7 @@ stage: Added - name: Added262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -2998,7 +2998,7 @@ stage: Added - name: Modified263 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3017,7 +3017,7 @@ stage: Modified - name: Added264 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3032,7 +3032,7 @@ stage: Added - name: Added265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3041,7 +3041,7 @@ stage: Added - name: Added266 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3056,7 +3056,7 @@ stage: Added - name: Added267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3065,7 +3065,7 @@ stage: Added - name: Added268 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3080,7 +3080,7 @@ stage: Added - name: Added269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3089,7 +3089,7 @@ stage: Added - name: Added270 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3104,7 +3104,7 @@ stage: Added - name: Added271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3113,7 +3113,7 @@ stage: Added - name: Added272 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3128,7 +3128,7 @@ stage: Added - name: Added273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3137,7 +3137,7 @@ stage: Added - name: Added274 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3152,7 +3152,7 @@ stage: Added - name: Added275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3161,7 +3161,7 @@ stage: Added - name: Added276 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3176,7 +3176,7 @@ stage: Added - name: Added277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3185,7 +3185,7 @@ stage: Added - name: Added278 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3200,7 +3200,7 @@ stage: Added - name: Added279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3209,14 +3209,14 @@ stage: Added - name: Added280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3225,21 +3225,21 @@ stage: Added - name: Modified282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added283 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3248,21 +3248,21 @@ stage: Added - name: Modified285 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3271,21 +3271,21 @@ stage: Added - name: Modified288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added289 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3294,21 +3294,21 @@ stage: Added - name: Modified291 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115","index":"234567890ABCDEF1234567890ABCDEF123456111","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3317,21 +3317,21 @@ stage: Added - name: Modified294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added295 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3340,21 +3340,21 @@ stage: Added - name: Modified297 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3363,21 +3363,21 @@ stage: Added - name: Modified300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added301 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3386,21 +3386,21 @@ stage: Added - name: Modified303 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722878,"checksum":"91a27351a1d558184aa0bb5c1ecdbac8dd7f737f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3409,14 +3409,14 @@ stage: Added - name: Added306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3425,14 +3425,14 @@ stage: Added - name: Added308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3441,14 +3441,14 @@ stage: Added - name: Added310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3457,14 +3457,14 @@ stage: Added - name: Added312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3473,14 +3473,14 @@ stage: Added - name: Added314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3489,14 +3489,14 @@ stage: Added - name: Added316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3505,14 +3505,14 @@ stage: Added - name: Added318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3521,7 +3521,7 @@ stage: Added - name: Added320 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3537,7 +3537,7 @@ stage: Added - name: Added321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3546,7 +3546,7 @@ stage: Added - name: Modified322 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3566,7 +3566,7 @@ stage: Modified - name: Added323 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3582,7 +3582,7 @@ stage: Added - name: Added324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3591,7 +3591,7 @@ stage: Added - name: Modified325 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3611,7 +3611,7 @@ stage: Modified - name: Added326 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3627,7 +3627,7 @@ stage: Added - name: Added327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3636,7 +3636,7 @@ stage: Added - name: Modified328 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3656,7 +3656,7 @@ stage: Modified - name: Added329 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3672,7 +3672,7 @@ stage: Added - name: Added330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3681,7 +3681,7 @@ stage: Added - name: Modified331 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3701,7 +3701,7 @@ stage: Modified - name: Added332 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3717,7 +3717,7 @@ stage: Added - name: Added333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -3726,7 +3726,7 @@ stage: Added - name: Modified334 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3746,7 +3746,7 @@ stage: Modified - name: Added335 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3762,7 +3762,7 @@ stage: Added - name: Added336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -3771,7 +3771,7 @@ stage: Added - name: Modified337 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3791,7 +3791,7 @@ stage: Modified - name: Added338 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3807,7 +3807,7 @@ stage: Added - name: Added339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -3816,7 +3816,7 @@ stage: Added - name: Modified340 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3836,7 +3836,7 @@ stage: Modified - name: Added341 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3852,7 +3852,7 @@ stage: Added - name: Added342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -3861,7 +3861,7 @@ stage: Added - name: Modified343 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3881,7 +3881,7 @@ stage: Modified - name: Added344 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3897,7 +3897,7 @@ stage: Added - name: Added345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3906,7 +3906,7 @@ stage: Added - name: Added346 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3922,7 +3922,7 @@ stage: Added - name: Added347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3931,7 +3931,7 @@ stage: Added - name: Added348 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3947,7 +3947,7 @@ stage: Added - name: Added349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3956,7 +3956,7 @@ stage: Added - name: Added350 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3972,7 +3972,7 @@ stage: Added - name: Added351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -3981,7 +3981,7 @@ stage: Added - name: Added352 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -3997,7 +3997,7 @@ stage: Added - name: Added353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4006,7 +4006,7 @@ stage: Added - name: Added354 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4022,7 +4022,7 @@ stage: Added - name: Added355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4031,7 +4031,7 @@ stage: Added - name: Added356 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4047,7 +4047,7 @@ stage: Added - name: Added357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4056,7 +4056,7 @@ stage: Added - name: Added358 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4072,7 +4072,7 @@ stage: Added - name: Added359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4081,7 +4081,7 @@ stage: Added - name: Added360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4089,7 +4089,7 @@ stage: Added - name: Added361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4098,7 +4098,7 @@ stage: Added - name: Modified362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4106,7 +4106,7 @@ stage: Modified - name: Added363 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4114,7 +4114,7 @@ stage: Added - name: Added364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4123,7 +4123,7 @@ stage: Added - name: Modified365 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4131,7 +4131,7 @@ stage: Modified - name: Added366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4139,7 +4139,7 @@ stage: Added - name: Added367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4148,7 +4148,7 @@ stage: Added - name: Modified368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4156,7 +4156,7 @@ stage: Modified - name: Added369 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4164,7 +4164,7 @@ stage: Added - name: Added370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4173,7 +4173,7 @@ stage: Added - name: Modified371 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4181,7 +4181,7 @@ stage: Modified - name: Added372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4189,7 +4189,7 @@ stage: Added - name: Added373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4198,7 +4198,7 @@ stage: Added - name: Modified374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4206,7 +4206,7 @@ stage: Modified - name: Added375 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4214,7 +4214,7 @@ stage: Added - name: Added376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4223,7 +4223,7 @@ stage: Added - name: Modified377 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4231,7 +4231,7 @@ stage: Modified - name: Added378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4239,7 +4239,7 @@ stage: Added - name: Added379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4248,7 +4248,7 @@ stage: Added - name: Modified380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4256,7 +4256,7 @@ stage: Modified - name: Added381 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4264,7 +4264,7 @@ stage: Added - name: Added382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4273,7 +4273,7 @@ stage: Added - name: Modified383 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"4d7f077b214192600d9b0821329539e072150a5d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4281,7 +4281,7 @@ stage: Modified - name: Added384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4289,7 +4289,7 @@ stage: Added - name: Added385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4298,7 +4298,7 @@ stage: Added - name: Added386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4306,7 +4306,7 @@ stage: Added - name: Added387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4315,7 +4315,7 @@ stage: Added - name: Added388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4323,7 +4323,7 @@ stage: Added - name: Added389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4332,7 +4332,7 @@ stage: Added - name: Added390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4340,7 +4340,7 @@ stage: Added - name: Added391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4349,7 +4349,7 @@ stage: Added - name: Added392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4357,7 +4357,7 @@ stage: Added - name: Added393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4366,7 +4366,7 @@ stage: Added - name: Added394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4374,7 +4374,7 @@ stage: Added - name: Added395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4383,7 +4383,7 @@ stage: Added - name: Added396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4391,7 +4391,7 @@ stage: Added - name: Added397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4400,7 +4400,7 @@ stage: Added - name: Added398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -4408,7 +4408,7 @@ stage: Added - name: Added399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4417,7 +4417,7 @@ stage: Added - name: Added400 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4433,7 +4433,7 @@ stage: Added - name: Added401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4442,7 +4442,7 @@ stage: Added - name: Modified402 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4462,7 +4462,7 @@ stage: Modified - name: Added403 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4478,7 +4478,7 @@ stage: Added - name: Added404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4487,7 +4487,7 @@ stage: Added - name: Modified405 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4507,7 +4507,7 @@ stage: Modified - name: Added406 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4523,7 +4523,7 @@ stage: Added - name: Added407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4532,7 +4532,7 @@ stage: Added - name: Modified408 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4552,7 +4552,7 @@ stage: Modified - name: Added409 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4568,7 +4568,7 @@ stage: Added - name: Added410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4577,7 +4577,7 @@ stage: Added - name: Modified411 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4597,7 +4597,7 @@ stage: Modified - name: Added412 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4613,7 +4613,7 @@ stage: Added - name: Added413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4622,7 +4622,7 @@ stage: Added - name: Modified414 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4642,7 +4642,7 @@ stage: Modified - name: Added415 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4658,7 +4658,7 @@ stage: Added - name: Added416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4667,7 +4667,7 @@ stage: Added - name: Modified417 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4687,7 +4687,7 @@ stage: Modified - name: Added418 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4703,7 +4703,7 @@ stage: Added - name: Added419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4712,7 +4712,7 @@ stage: Added - name: Modified420 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4732,7 +4732,7 @@ stage: Modified - name: Added421 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4748,7 +4748,7 @@ stage: Added - name: Added422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4757,7 +4757,7 @@ stage: Added - name: Modified423 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4777,7 +4777,7 @@ stage: Modified - name: Added424 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4792,7 +4792,7 @@ stage: Added - name: Added425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4801,7 +4801,7 @@ stage: Added - name: Added426 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4816,7 +4816,7 @@ stage: Added - name: Added427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4825,7 +4825,7 @@ stage: Added - name: Added428 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4840,7 +4840,7 @@ stage: Added - name: Added429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4849,7 +4849,7 @@ stage: Added - name: Added430 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4864,7 +4864,7 @@ stage: Added - name: Added431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4873,7 +4873,7 @@ stage: Added - name: Added432 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4888,7 +4888,7 @@ stage: Added - name: Added433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4897,7 +4897,7 @@ stage: Added - name: Added434 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4912,7 +4912,7 @@ stage: Added - name: Added435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4921,7 +4921,7 @@ stage: Added - name: Added436 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4936,7 +4936,7 @@ stage: Added - name: Added437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4945,7 +4945,7 @@ stage: Added - name: Added438 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -4960,7 +4960,7 @@ stage: Added - name: Added439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -4969,7 +4969,7 @@ stage: Added - name: Added440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key", "arch": "[x64]", "timestamp": 1606769868, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -4977,7 +4977,7 @@ stage: Added - name: Added441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -4986,7 +4986,7 @@ stage: Added - name: Modified442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -4994,7 +4994,7 @@ stage: Modified - name: Added443 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5002,7 +5002,7 @@ stage: Added - name: Added444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5011,7 +5011,7 @@ stage: Added - name: Modified445 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5019,7 +5019,7 @@ stage: Modified - name: Added446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5027,7 +5027,7 @@ stage: Added - name: Added447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5036,7 +5036,7 @@ stage: Added - name: Modified448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5044,7 +5044,7 @@ stage: Modified - name: Added449 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5052,7 +5052,7 @@ stage: Added - name: Added450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5061,7 +5061,7 @@ stage: Added - name: Modified451 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5069,7 +5069,7 @@ stage: Modified - name: Added452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5077,7 +5077,7 @@ stage: Added - name: Added453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5086,7 +5086,7 @@ stage: Added - name: Modified454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5094,7 +5094,7 @@ stage: Modified - name: Added455 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5102,7 +5102,7 @@ stage: Added - name: Added456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5111,7 +5111,7 @@ stage: Added - name: Modified457 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5119,7 +5119,7 @@ stage: Modified - name: Added458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5127,7 +5127,7 @@ stage: Added - name: Added459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5136,7 +5136,7 @@ stage: Added - name: Modified460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5144,7 +5144,7 @@ stage: Modified - name: Added461 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5152,7 +5152,7 @@ stage: Added - name: Added462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5161,7 +5161,7 @@ stage: Added - name: Modified463 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722878,"checksum":"2b3a8a36042df8587b8f49e915de9692e7d162ad"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723044, @@ -5169,14 +5169,14 @@ stage: Modified - name: Added464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5185,14 +5185,14 @@ stage: Added - name: Added466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5201,14 +5201,14 @@ stage: Added - name: Added468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5217,14 +5217,14 @@ stage: Added - name: Added470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5233,14 +5233,14 @@ stage: Added - name: Added472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5249,14 +5249,14 @@ stage: Added - name: Added474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5265,14 +5265,14 @@ stage: Added - name: Added476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5281,14 +5281,14 @@ stage: Added - name: Added478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5297,7 +5297,7 @@ stage: Added - name: Added480 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5313,7 +5313,7 @@ stage: Added - name: Added481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5322,7 +5322,7 @@ stage: Added - name: Modified482 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5342,7 +5342,7 @@ stage: Modified - name: Added483 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5358,7 +5358,7 @@ stage: Added - name: Added484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5367,7 +5367,7 @@ stage: Added - name: Modified485 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5387,7 +5387,7 @@ stage: Modified - name: Added486 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5403,7 +5403,7 @@ stage: Added - name: Added487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5412,7 +5412,7 @@ stage: Added - name: Modified488 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5432,7 +5432,7 @@ stage: Modified - name: Added489 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5448,7 +5448,7 @@ stage: Added - name: Added490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5457,7 +5457,7 @@ stage: Added - name: Modified491 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5477,7 +5477,7 @@ stage: Modified - name: Added492 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5493,7 +5493,7 @@ stage: Added - name: Added493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5502,7 +5502,7 @@ stage: Added - name: Modified494 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5522,7 +5522,7 @@ stage: Modified - name: Added495 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5538,7 +5538,7 @@ stage: Added - name: Added496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5547,7 +5547,7 @@ stage: Added - name: Modified497 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5567,7 +5567,7 @@ stage: Modified - name: Added498 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5583,7 +5583,7 @@ stage: Added - name: Added499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5592,7 +5592,7 @@ stage: Added - name: Modified500 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5612,7 +5612,7 @@ stage: Modified - name: Added501 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5628,7 +5628,7 @@ stage: Added - name: Added502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5637,7 +5637,7 @@ stage: Added - name: Modified503 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5657,7 +5657,7 @@ stage: Modified - name: Added504 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5673,7 +5673,7 @@ stage: Added - name: Added505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5682,7 +5682,7 @@ stage: Added - name: Added506 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5698,7 +5698,7 @@ stage: Added - name: Added507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5707,7 +5707,7 @@ stage: Added - name: Added508 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5723,7 +5723,7 @@ stage: Added - name: Added509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5732,7 +5732,7 @@ stage: Added - name: Added510 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5748,7 +5748,7 @@ stage: Added - name: Added511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5757,7 +5757,7 @@ stage: Added - name: Added512 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5773,7 +5773,7 @@ stage: Added - name: Added513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5782,7 +5782,7 @@ stage: Added - name: Added514 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5798,7 +5798,7 @@ stage: Added - name: Added515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5807,7 +5807,7 @@ stage: Added - name: Added516 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5823,7 +5823,7 @@ stage: Added - name: Added517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5832,7 +5832,7 @@ stage: Added - name: Added518 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -5848,7 +5848,7 @@ stage: Added - name: Added519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5857,7 +5857,7 @@ stage: Added - name: Added520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -5865,7 +5865,7 @@ stage: Added - name: Added521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5874,7 +5874,7 @@ stage: Added - name: Modified522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -5882,7 +5882,7 @@ stage: Modified - name: Added523 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -5890,7 +5890,7 @@ stage: Added - name: Added524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5899,7 +5899,7 @@ stage: Added - name: Modified525 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -5907,7 +5907,7 @@ stage: Modified - name: Added526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -5915,7 +5915,7 @@ stage: Added - name: Added527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5924,7 +5924,7 @@ stage: Added - name: Modified528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -5932,7 +5932,7 @@ stage: Modified - name: Added529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -5940,7 +5940,7 @@ stage: Added - name: Added530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -5949,7 +5949,7 @@ stage: Added - name: Modified531 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -5957,7 +5957,7 @@ stage: Modified - name: Added532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -5965,7 +5965,7 @@ stage: Added - name: Added533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5974,7 +5974,7 @@ stage: Added - name: Modified534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -5982,7 +5982,7 @@ stage: Modified - name: Added535 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -5990,7 +5990,7 @@ stage: Added - name: Added536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -5999,7 +5999,7 @@ stage: Added - name: Modified537 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -6007,7 +6007,7 @@ stage: Modified - name: Added538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -6015,7 +6015,7 @@ stage: Added - name: Added539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6024,7 +6024,7 @@ stage: Added - name: Modified540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -6032,7 +6032,7 @@ stage: Modified - name: Added541 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -6040,7 +6040,7 @@ stage: Added - name: Added542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6049,7 +6049,7 @@ stage: Added - name: Modified543 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722878,"checksum":"b3b4275468d419b758262b26ebd5d05e014933cc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -6057,7 +6057,7 @@ stage: Modified - name: Added544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -6065,7 +6065,7 @@ stage: Added - name: Added545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6074,7 +6074,7 @@ stage: Added - name: Added546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -6082,7 +6082,7 @@ stage: Added - name: Added547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6091,7 +6091,7 @@ stage: Added - name: Added548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -6099,7 +6099,7 @@ stage: Added - name: Added549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6108,7 +6108,7 @@ stage: Added - name: Added550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -6116,7 +6116,7 @@ stage: Added - name: Added551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6125,7 +6125,7 @@ stage: Added - name: Added552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -6133,7 +6133,7 @@ stage: Added - name: Added553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6142,7 +6142,7 @@ stage: Added - name: Added554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -6150,7 +6150,7 @@ stage: Added - name: Added555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6159,7 +6159,7 @@ stage: Added - name: Added556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -6167,7 +6167,7 @@ stage: Added - name: Added557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6176,7 +6176,7 @@ stage: Added - name: Added558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -6184,7 +6184,7 @@ stage: Added - name: Added559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6193,7 +6193,7 @@ stage: Added - name: Added560 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6208,7 +6208,7 @@ stage: Added - name: Added561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6217,7 +6217,7 @@ stage: Added - name: Modified562 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6236,7 +6236,7 @@ stage: Modified - name: Added563 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6251,7 +6251,7 @@ stage: Added - name: Added564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6260,7 +6260,7 @@ stage: Added - name: Modified565 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6279,7 +6279,7 @@ stage: Modified - name: Added566 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6294,7 +6294,7 @@ stage: Added - name: Added567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6303,7 +6303,7 @@ stage: Added - name: Modified568 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6322,7 +6322,7 @@ stage: Modified - name: Added569 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6337,7 +6337,7 @@ stage: Added - name: Added570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6346,7 +6346,7 @@ stage: Added - name: Modified571 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6365,7 +6365,7 @@ stage: Modified - name: Added572 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6380,7 +6380,7 @@ stage: Added - name: Added573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6389,7 +6389,7 @@ stage: Added - name: Modified574 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6408,7 +6408,7 @@ stage: Modified - name: Added575 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6423,7 +6423,7 @@ stage: Added - name: Added576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6432,7 +6432,7 @@ stage: Added - name: Modified577 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6451,7 +6451,7 @@ stage: Modified - name: Added578 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6466,7 +6466,7 @@ stage: Added - name: Added579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6475,7 +6475,7 @@ stage: Added - name: Modified580 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6494,7 +6494,7 @@ stage: Modified - name: Added581 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6509,7 +6509,7 @@ stage: Added - name: Added582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6518,7 +6518,7 @@ stage: Added - name: Modified583 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6537,7 +6537,7 @@ stage: Modified - name: Added584 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6552,7 +6552,7 @@ stage: Added - name: Added585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6561,7 +6561,7 @@ stage: Added - name: Added586 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6576,7 +6576,7 @@ stage: Added - name: Added587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6585,7 +6585,7 @@ stage: Added - name: Added588 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6600,7 +6600,7 @@ stage: Added - name: Added589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6609,7 +6609,7 @@ stage: Added - name: Added590 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6624,7 +6624,7 @@ stage: Added - name: Added591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6633,7 +6633,7 @@ stage: Added - name: Added592 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6648,7 +6648,7 @@ stage: Added - name: Added593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6657,7 +6657,7 @@ stage: Added - name: Added594 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6672,7 +6672,7 @@ stage: Added - name: Added595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6681,7 +6681,7 @@ stage: Added - name: Added596 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6696,7 +6696,7 @@ stage: Added - name: Added597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6705,7 +6705,7 @@ stage: Added - name: Added598 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -6720,7 +6720,7 @@ stage: Added - name: Added599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6729,14 +6729,14 @@ stage: Added - name: Added600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6745,21 +6745,21 @@ stage: Added - name: Modified602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added603 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6768,21 +6768,21 @@ stage: Added - name: Modified605 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6791,21 +6791,21 @@ stage: Added - name: Modified608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added609 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6814,21 +6814,21 @@ stage: Added - name: Modified611 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6837,21 +6837,21 @@ stage: Added - name: Modified614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added615 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6860,21 +6860,21 @@ stage: Added - name: Modified617 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6883,21 +6883,21 @@ stage: Added - name: Modified620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added621 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Added - name: Added622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6906,21 +6906,21 @@ stage: Added - name: Modified623 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "mtime": 1606723044, "checksum": "57113e0a23727b84d8df49c527a94ee706a6ebff"}}' stage: Modified - name: Added624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6929,14 +6929,14 @@ stage: Added - name: Added626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6945,14 +6945,14 @@ stage: Added - name: Added628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6961,14 +6961,14 @@ stage: Added - name: Added630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -6977,14 +6977,14 @@ stage: Added - name: Added632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -6993,14 +6993,14 @@ stage: Added - name: Added634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -7009,14 +7009,14 @@ stage: Added - name: Added636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -7025,14 +7025,14 @@ stage: Added - name: Added638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -7041,7 +7041,7 @@ stage: Added - name: Added640 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7057,7 +7057,7 @@ stage: Added - name: Added641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7065,7 +7065,7 @@ stage: Added - name: Modified642 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7085,7 +7085,7 @@ stage: Modified - name: Added643 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7101,7 +7101,7 @@ stage: Added - name: Added644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7109,7 +7109,7 @@ stage: Added - name: Modified645 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7129,7 +7129,7 @@ stage: Modified - name: Added646 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7145,7 +7145,7 @@ stage: Added - name: Added647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7153,7 +7153,7 @@ stage: Added - name: Modified648 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7173,7 +7173,7 @@ stage: Modified - name: Added649 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7189,7 +7189,7 @@ stage: Added - name: Added650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7197,7 +7197,7 @@ stage: Added - name: Modified651 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7217,7 +7217,7 @@ stage: Modified - name: Added652 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7233,7 +7233,7 @@ stage: Added - name: Added653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7241,7 +7241,7 @@ stage: Added - name: Modified654 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7261,7 +7261,7 @@ stage: Modified - name: Added655 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7277,7 +7277,7 @@ stage: Added - name: Added656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7285,7 +7285,7 @@ stage: Added - name: Modified657 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7305,7 +7305,7 @@ stage: Modified - name: Added658 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7321,7 +7321,7 @@ stage: Added - name: Added659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7329,7 +7329,7 @@ stage: Added - name: Modified660 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7349,7 +7349,7 @@ stage: Modified - name: Added661 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7365,7 +7365,7 @@ stage: Added - name: Added662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7373,7 +7373,7 @@ stage: Added - name: Modified663 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7393,7 +7393,7 @@ stage: Modified - name: Added664 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7409,7 +7409,7 @@ stage: Added - name: Added665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7417,7 +7417,7 @@ stage: Added - name: Added666 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7433,7 +7433,7 @@ stage: Added - name: Added667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7441,7 +7441,7 @@ stage: Added - name: Added668 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7457,7 +7457,7 @@ stage: Added - name: Added669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7465,7 +7465,7 @@ stage: Added - name: Added670 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7481,7 +7481,7 @@ stage: Added - name: Added671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7489,7 +7489,7 @@ stage: Added - name: Added672 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg268\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7505,7 +7505,7 @@ stage: Added - name: Added673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg268\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg268\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7513,7 +7513,7 @@ stage: Added - name: Added674 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg269\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7529,7 +7529,7 @@ stage: Added - name: Added675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg269\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg269\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7537,7 +7537,7 @@ stage: Added - name: Added676 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg270\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7553,7 +7553,7 @@ stage: Added - name: Added677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg270\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg270\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7561,7 +7561,7 @@ stage: Added - name: Added678 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg271\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7577,7 +7577,7 @@ stage: Added - name: Added679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg271\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg271\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7585,7 +7585,7 @@ stage: Added - name: Added680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7593,7 +7593,7 @@ stage: Added - name: Added681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7601,7 +7601,7 @@ stage: Added - name: Modified682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7609,7 +7609,7 @@ stage: Modified - name: Added683 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7617,7 +7617,7 @@ stage: Added - name: Added684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7625,7 +7625,7 @@ stage: Added - name: Modified685 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7633,7 +7633,7 @@ stage: Modified - name: Added686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7641,7 +7641,7 @@ stage: Added - name: Added687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7649,7 +7649,7 @@ stage: Added - name: Modified688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7657,7 +7657,7 @@ stage: Modified - name: Added689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7665,7 +7665,7 @@ stage: Added - name: Added690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7673,7 +7673,7 @@ stage: Added - name: Modified691 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7681,7 +7681,7 @@ stage: Modified - name: Added692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7689,7 +7689,7 @@ stage: Added - name: Added693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7697,7 +7697,7 @@ stage: Added - name: Modified694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7705,7 +7705,7 @@ stage: Modified - name: Added695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7713,7 +7713,7 @@ stage: Added - name: Added696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7721,7 +7721,7 @@ stage: Added - name: Modified697 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7729,7 +7729,7 @@ stage: Modified - name: Added698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7737,7 +7737,7 @@ stage: Added - name: Added699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7745,7 +7745,7 @@ stage: Added - name: Modified700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7753,7 +7753,7 @@ stage: Modified - name: Added701 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7761,7 +7761,7 @@ stage: Added - name: Added702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7769,7 +7769,7 @@ stage: Added - name: Modified703 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7777,7 +7777,7 @@ stage: Modified - name: Added704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7785,7 +7785,7 @@ stage: Added - name: Added705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7793,7 +7793,7 @@ stage: Added - name: Added706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7801,7 +7801,7 @@ stage: Added - name: Added707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7809,7 +7809,7 @@ stage: Added - name: Added708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7817,7 +7817,7 @@ stage: Added - name: Added709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7825,7 +7825,7 @@ stage: Added - name: Added710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7833,7 +7833,7 @@ stage: Added - name: Added711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7841,7 +7841,7 @@ stage: Added - name: Added712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7849,7 +7849,7 @@ stage: Added - name: Added713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7857,7 +7857,7 @@ stage: Added - name: Added714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7865,7 +7865,7 @@ stage: Added - name: Added715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7873,7 +7873,7 @@ stage: Added - name: Added716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7881,7 +7881,7 @@ stage: Added - name: Added717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7889,7 +7889,7 @@ stage: Added - name: Added718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -7897,7 +7897,7 @@ stage: Added - name: Added719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7905,7 +7905,7 @@ stage: Added - name: Added720 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7921,7 +7921,7 @@ stage: Added - name: Added721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7929,7 +7929,7 @@ stage: Added - name: Modified722 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7949,7 +7949,7 @@ stage: Modified - name: Added723 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7965,7 +7965,7 @@ stage: Added - name: Added724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -7973,7 +7973,7 @@ stage: Added - name: Modified725 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -7993,7 +7993,7 @@ stage: Modified - name: Added726 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8009,7 +8009,7 @@ stage: Added - name: Added727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8017,7 +8017,7 @@ stage: Added - name: Modified728 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8037,7 +8037,7 @@ stage: Modified - name: Added729 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8053,7 +8053,7 @@ stage: Added - name: Added730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8061,7 +8061,7 @@ stage: Added - name: Modified731 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8081,7 +8081,7 @@ stage: Modified - name: Added732 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8097,7 +8097,7 @@ stage: Added - name: Added733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8105,7 +8105,7 @@ stage: Added - name: Modified734 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8125,7 +8125,7 @@ stage: Modified - name: Added735 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8141,7 +8141,7 @@ stage: Added - name: Added736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8149,7 +8149,7 @@ stage: Added - name: Modified737 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8169,7 +8169,7 @@ stage: Modified - name: Added738 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8185,7 +8185,7 @@ stage: Added - name: Added739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8193,7 +8193,7 @@ stage: Added - name: Modified740 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8213,7 +8213,7 @@ stage: Modified - name: Added741 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8229,7 +8229,7 @@ stage: Added - name: Added742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8237,7 +8237,7 @@ stage: Added - name: Modified743 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8257,7 +8257,7 @@ stage: Modified - name: Added744 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg296\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8272,7 +8272,7 @@ stage: Added - name: Added745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg296\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg296\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8280,7 +8280,7 @@ stage: Added - name: Added746 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg297\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8295,7 +8295,7 @@ stage: Added - name: Added747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg297\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg297\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8303,7 +8303,7 @@ stage: Added - name: Added748 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg298\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8318,7 +8318,7 @@ stage: Added - name: Added749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg298\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg298\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8326,7 +8326,7 @@ stage: Added - name: Added750 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg299\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8341,7 +8341,7 @@ stage: Added - name: Added751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg299\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg299\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8349,7 +8349,7 @@ stage: Added - name: Added752 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg300\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8364,7 +8364,7 @@ stage: Added - name: Added753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg300\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg300\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8372,7 +8372,7 @@ stage: Added - name: Added754 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg301\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8387,7 +8387,7 @@ stage: Added - name: Added755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg301\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg301\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8395,7 +8395,7 @@ stage: Added - name: Added756 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg302\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8410,7 +8410,7 @@ stage: Added - name: Added757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg302\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg302\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8418,7 +8418,7 @@ stage: Added - name: Added758 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg303\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8433,7 +8433,7 @@ stage: Added - name: Added759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg303\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg303\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8441,7 +8441,7 @@ stage: Added - name: Added760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8449,7 +8449,7 @@ stage: Added - name: Added761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8457,7 +8457,7 @@ stage: Added - name: Modified762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8465,7 +8465,7 @@ stage: Modified - name: Added763 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8473,7 +8473,7 @@ stage: Added - name: Added764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8481,7 +8481,7 @@ stage: Added - name: Modified765 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8489,7 +8489,7 @@ stage: Modified - name: Added766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8497,7 +8497,7 @@ stage: Added - name: Added767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8505,7 +8505,7 @@ stage: Added - name: Modified768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8513,7 +8513,7 @@ stage: Modified - name: Added769 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8521,7 +8521,7 @@ stage: Added - name: Added770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8529,7 +8529,7 @@ stage: Added - name: Modified771 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8537,7 +8537,7 @@ stage: Modified - name: Added772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8545,7 +8545,7 @@ stage: Added - name: Added773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8553,7 +8553,7 @@ stage: Added - name: Modified774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8561,7 +8561,7 @@ stage: Modified - name: Added775 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8569,7 +8569,7 @@ stage: Added - name: Added776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8577,7 +8577,7 @@ stage: Added - name: Modified777 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8585,7 +8585,7 @@ stage: Modified - name: Added778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8593,7 +8593,7 @@ stage: Added - name: Added779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8601,7 +8601,7 @@ stage: Added - name: Modified780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8609,7 +8609,7 @@ stage: Modified - name: Added781 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8617,7 +8617,7 @@ stage: Added - name: Added782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8625,7 +8625,7 @@ stage: Added - name: Modified783 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -8633,14 +8633,14 @@ stage: Modified - name: Added784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8648,14 +8648,14 @@ stage: Added - name: Added786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8663,14 +8663,14 @@ stage: Added - name: Added788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8678,14 +8678,14 @@ stage: Added - name: Added790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8693,14 +8693,14 @@ stage: Added - name: Added792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8708,14 +8708,14 @@ stage: Added - name: Added794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8723,14 +8723,14 @@ stage: Added - name: Added796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8738,14 +8738,14 @@ stage: Added - name: Added798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8753,7 +8753,7 @@ stage: Added - name: Added800 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8769,7 +8769,7 @@ stage: Added - name: Added801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8777,7 +8777,7 @@ stage: Added - name: Modified802 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8797,7 +8797,7 @@ stage: Modified - name: Added803 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8813,7 +8813,7 @@ stage: Added - name: Added804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8821,7 +8821,7 @@ stage: Added - name: Modified805 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8841,7 +8841,7 @@ stage: Modified - name: Added806 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8857,7 +8857,7 @@ stage: Added - name: Added807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8865,7 +8865,7 @@ stage: Added - name: Modified808 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8885,7 +8885,7 @@ stage: Modified - name: Added809 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8901,7 +8901,7 @@ stage: Added - name: Added810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8909,7 +8909,7 @@ stage: Added - name: Modified811 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8929,7 +8929,7 @@ stage: Modified - name: Added812 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8945,7 +8945,7 @@ stage: Added - name: Added813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8953,7 +8953,7 @@ stage: Added - name: Modified814 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8973,7 +8973,7 @@ stage: Modified - name: Added815 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -8989,7 +8989,7 @@ stage: Added - name: Added816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -8997,7 +8997,7 @@ stage: Added - name: Modified817 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9017,7 +9017,7 @@ stage: Modified - name: Added818 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9033,7 +9033,7 @@ stage: Added - name: Added819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9041,7 +9041,7 @@ stage: Added - name: Modified820 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9061,7 +9061,7 @@ stage: Modified - name: Added821 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9077,7 +9077,7 @@ stage: Added - name: Added822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9085,7 +9085,7 @@ stage: Added - name: Modified823 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9105,7 +9105,7 @@ stage: Modified - name: Added824 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg328\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9121,7 +9121,7 @@ stage: Added - name: Added825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg328\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg328\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9129,7 +9129,7 @@ stage: Added - name: Added826 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg329\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9145,7 +9145,7 @@ stage: Added - name: Added827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg329\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg329\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9153,7 +9153,7 @@ stage: Added - name: Added828 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg330\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9169,7 +9169,7 @@ stage: Added - name: Added829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg330\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg330\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9177,7 +9177,7 @@ stage: Added - name: Added830 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg331\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9193,7 +9193,7 @@ stage: Added - name: Added831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg331\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg331\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9201,7 +9201,7 @@ stage: Added - name: Added832 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg332\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9217,7 +9217,7 @@ stage: Added - name: Added833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg332\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg332\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9225,7 +9225,7 @@ stage: Added - name: Added834 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg333\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9241,7 +9241,7 @@ stage: Added - name: Added835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg333\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg333\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9249,7 +9249,7 @@ stage: Added - name: Added836 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg334\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9265,7 +9265,7 @@ stage: Added - name: Added837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg334\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg334\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9273,7 +9273,7 @@ stage: Added - name: Added838 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg335\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9289,7 +9289,7 @@ stage: Added - name: Added839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg335\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg335\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9297,7 +9297,7 @@ stage: Added - name: Added840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9305,7 +9305,7 @@ stage: Added - name: Added841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9313,7 +9313,7 @@ stage: Added - name: Modified842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9321,7 +9321,7 @@ stage: Modified - name: Added843 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9329,7 +9329,7 @@ stage: Added - name: Added844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9337,7 +9337,7 @@ stage: Added - name: Modified845 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9345,7 +9345,7 @@ stage: Modified - name: Added846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9353,7 +9353,7 @@ stage: Added - name: Added847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9361,7 +9361,7 @@ stage: Added - name: Modified848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9369,7 +9369,7 @@ stage: Modified - name: Added849 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9377,7 +9377,7 @@ stage: Added - name: Added850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9385,7 +9385,7 @@ stage: Added - name: Modified851 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9393,7 +9393,7 @@ stage: Modified - name: Added852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9401,7 +9401,7 @@ stage: Added - name: Added853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9409,7 +9409,7 @@ stage: Added - name: Modified854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9417,7 +9417,7 @@ stage: Modified - name: Added855 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9425,7 +9425,7 @@ stage: Added - name: Added856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9433,7 +9433,7 @@ stage: Added - name: Modified857 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9441,7 +9441,7 @@ stage: Modified - name: Added858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9449,7 +9449,7 @@ stage: Added - name: Added859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9457,7 +9457,7 @@ stage: Added - name: Modified860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9465,7 +9465,7 @@ stage: Modified - name: Added861 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9473,7 +9473,7 @@ stage: Added - name: Added862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9481,7 +9481,7 @@ stage: Added - name: Modified863 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -9489,7 +9489,7 @@ stage: Modified - name: Added864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg344\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg344\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -9497,7 +9497,7 @@ stage: Added - name: Added865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg344\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg344\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9505,7 +9505,7 @@ stage: Added - name: Added866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg345\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg345\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -9513,7 +9513,7 @@ stage: Added - name: Added867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg345\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg345\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9521,7 +9521,7 @@ stage: Added - name: Added868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg346\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg346\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -9529,7 +9529,7 @@ stage: Added - name: Added869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg346\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg346\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9537,7 +9537,7 @@ stage: Added - name: Added870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg347\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg347\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -9545,7 +9545,7 @@ stage: Added - name: Added871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg347\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg347\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9553,7 +9553,7 @@ stage: Added - name: Added872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg348\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg348\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -9561,7 +9561,7 @@ stage: Added - name: Added873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg348\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg348\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9569,7 +9569,7 @@ stage: Added - name: Added874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg349\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg349\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -9577,7 +9577,7 @@ stage: Added - name: Added875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg349\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg349\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9585,7 +9585,7 @@ stage: Added - name: Added876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg350\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg350\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -9593,7 +9593,7 @@ stage: Added - name: Added877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg350\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg350\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9601,7 +9601,7 @@ stage: Added - name: Added878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg351\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg351\\reg_key", "arch": "[x64]", "timestamp": 1606769869, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -9609,7 +9609,7 @@ stage: Added - name: Added879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg351\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg351\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9617,7 +9617,7 @@ stage: Added - name: Added880 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9632,7 +9632,7 @@ stage: Added - name: Added881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9640,7 +9640,7 @@ stage: Added - name: Modified882 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9659,7 +9659,7 @@ stage: Modified - name: Added883 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9674,7 +9674,7 @@ stage: Added - name: Added884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9682,7 +9682,7 @@ stage: Added - name: Modified885 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9701,7 +9701,7 @@ stage: Modified - name: Added886 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9716,7 +9716,7 @@ stage: Added - name: Added887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9724,7 +9724,7 @@ stage: Added - name: Modified888 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9743,7 +9743,7 @@ stage: Modified - name: Added889 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9758,7 +9758,7 @@ stage: Added - name: Added890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9766,7 +9766,7 @@ stage: Added - name: Modified891 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9785,7 +9785,7 @@ stage: Modified - name: Added892 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9800,7 +9800,7 @@ stage: Added - name: Added893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9808,7 +9808,7 @@ stage: Added - name: Modified894 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9827,7 +9827,7 @@ stage: Modified - name: Added895 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9842,7 +9842,7 @@ stage: Added - name: Added896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9850,7 +9850,7 @@ stage: Added - name: Modified897 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9869,7 +9869,7 @@ stage: Modified - name: Added898 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9884,7 +9884,7 @@ stage: Added - name: Added899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9892,7 +9892,7 @@ stage: Added - name: Modified900 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9911,7 +9911,7 @@ stage: Modified - name: Added901 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9926,7 +9926,7 @@ stage: Added - name: Added902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9934,7 +9934,7 @@ stage: Added - name: Modified903 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9953,7 +9953,7 @@ stage: Modified - name: Added904 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg360\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9968,7 +9968,7 @@ stage: Added - name: Added905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg360\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg360\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9976,7 +9976,7 @@ stage: Added - name: Added906 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg361\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -9991,7 +9991,7 @@ stage: Added - name: Added907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg361\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg361\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -9999,7 +9999,7 @@ stage: Added - name: Added908 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg362\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10014,7 +10014,7 @@ stage: Added - name: Added909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg362\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg362\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10022,7 +10022,7 @@ stage: Added - name: Added910 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg363\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10037,7 +10037,7 @@ stage: Added - name: Added911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg363\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg363\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10045,7 +10045,7 @@ stage: Added - name: Added912 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg364\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10060,7 +10060,7 @@ stage: Added - name: Added913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg364\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg364\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10068,7 +10068,7 @@ stage: Added - name: Added914 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg365\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10083,7 +10083,7 @@ stage: Added - name: Added915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg365\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769869,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg365\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769869, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10091,7 +10091,7 @@ stage: Added - name: Added916 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg366\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10106,7 +10106,7 @@ stage: Added - name: Added917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg366\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg366\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10114,7 +10114,7 @@ stage: Added - name: Added918 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg367\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10129,7 +10129,7 @@ stage: Added - name: Added919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg367\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg367\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10137,14 +10137,14 @@ stage: Added - name: Added920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Added - name: Added921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10152,21 +10152,21 @@ stage: Added - name: Modified922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Modified - name: Added923 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Added - name: Added924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10174,21 +10174,21 @@ stage: Added - name: Modified925 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Modified - name: Added926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Added - name: Added927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10196,21 +10196,21 @@ stage: Added - name: Modified928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Modified - name: Added929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Added - name: Added930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10218,21 +10218,21 @@ stage: Added - name: Modified931 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Modified - name: Added932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Added - name: Added933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10240,21 +10240,21 @@ stage: Added - name: Modified934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Modified - name: Added935 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Added - name: Added936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10262,21 +10262,21 @@ stage: Added - name: Modified937 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Modified - name: Added938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Added - name: Added939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10284,21 +10284,21 @@ stage: Added - name: Modified940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Modified - name: Added941 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Added - name: Added942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10306,21 +10306,21 @@ stage: Added - name: Modified943 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "mtime": 1606723045, "checksum": "57f6bec2778f58dcb8502e90d62048d5b71929bc"}}' stage: Modified - name: Added944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg376\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg376\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg376\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg376\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10328,14 +10328,14 @@ stage: Added - name: Added946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg377\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg377\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg377\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg377\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10343,14 +10343,14 @@ stage: Added - name: Added948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg378\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg378\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg378\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg378\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10358,14 +10358,14 @@ stage: Added - name: Added950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg379\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg379\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg379\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg379\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10373,14 +10373,14 @@ stage: Added - name: Added952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg380\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg380\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg380\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg380\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10388,14 +10388,14 @@ stage: Added - name: Added954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg381\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg381\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg381\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg381\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10403,14 +10403,14 @@ stage: Added - name: Added956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg382\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg382\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg382\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg382\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10418,14 +10418,14 @@ stage: Added - name: Added958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg383\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg383\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg383\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg383\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10433,7 +10433,7 @@ stage: Added - name: Added960 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10449,7 +10449,7 @@ stage: Added - name: Added961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10457,7 +10457,7 @@ stage: Added - name: Modified962 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10477,7 +10477,7 @@ stage: Modified - name: Added963 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10493,7 +10493,7 @@ stage: Added - name: Added964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10501,7 +10501,7 @@ stage: Added - name: Modified965 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10521,7 +10521,7 @@ stage: Modified - name: Added966 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10537,7 +10537,7 @@ stage: Added - name: Added967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10545,7 +10545,7 @@ stage: Added - name: Modified968 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10565,7 +10565,7 @@ stage: Modified - name: Added969 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10581,7 +10581,7 @@ stage: Added - name: Added970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10589,7 +10589,7 @@ stage: Added - name: Modified971 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10609,7 +10609,7 @@ stage: Modified - name: Added972 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10625,7 +10625,7 @@ stage: Added - name: Added973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -10633,7 +10633,7 @@ stage: Added - name: Modified974 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10653,7 +10653,7 @@ stage: Modified - name: Added975 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10669,7 +10669,7 @@ stage: Added - name: Added976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -10677,7 +10677,7 @@ stage: Added - name: Modified977 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10697,7 +10697,7 @@ stage: Modified - name: Added978 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10713,7 +10713,7 @@ stage: Added - name: Added979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -10721,7 +10721,7 @@ stage: Added - name: Modified980 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10741,7 +10741,7 @@ stage: Modified - name: Added981 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10757,7 +10757,7 @@ stage: Added - name: Added982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -10765,7 +10765,7 @@ stage: Added - name: Modified983 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10785,7 +10785,7 @@ stage: Modified - name: Added984 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg392\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10801,7 +10801,7 @@ stage: Added - name: Added985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg392\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg392\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10809,7 +10809,7 @@ stage: Added - name: Added986 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg393\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10825,7 +10825,7 @@ stage: Added - name: Added987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg393\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg393\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10833,7 +10833,7 @@ stage: Added - name: Added988 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg394\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10849,7 +10849,7 @@ stage: Added - name: Added989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg394\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg394\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10857,7 +10857,7 @@ stage: Added - name: Added990 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg395\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10873,7 +10873,7 @@ stage: Added - name: Added991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg395\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg395\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10881,7 +10881,7 @@ stage: Added - name: Added992 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg396\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10897,7 +10897,7 @@ stage: Added - name: Added993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg396\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg396\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -10905,7 +10905,7 @@ stage: Added - name: Added994 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg397\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10921,7 +10921,7 @@ stage: Added - name: Added995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg397\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg397\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -10929,7 +10929,7 @@ stage: Added - name: Added996 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg398\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10945,7 +10945,7 @@ stage: Added - name: Added997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg398\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg398\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -10953,7 +10953,7 @@ stage: Added - name: Added998 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg399\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -10969,7 +10969,7 @@ stage: Added - name: Added999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg399\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg399\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -10977,7 +10977,7 @@ stage: Added - name: Added1000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -10985,7 +10985,7 @@ stage: Added - name: Added1001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -10993,7 +10993,7 @@ stage: Added - name: Modified1002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11001,7 +11001,7 @@ stage: Modified - name: Added1003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11009,7 +11009,7 @@ stage: Added - name: Added1004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11017,7 +11017,7 @@ stage: Added - name: Modified1005 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11025,7 +11025,7 @@ stage: Modified - name: Added1006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11033,7 +11033,7 @@ stage: Added - name: Added1007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11041,7 +11041,7 @@ stage: Added - name: Modified1008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11049,7 +11049,7 @@ stage: Modified - name: Added1009 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11057,7 +11057,7 @@ stage: Added - name: Added1010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11065,7 +11065,7 @@ stage: Added - name: Modified1011 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11073,7 +11073,7 @@ stage: Modified - name: Added1012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11081,7 +11081,7 @@ stage: Added - name: Added1013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11089,7 +11089,7 @@ stage: Added - name: Modified1014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11097,7 +11097,7 @@ stage: Modified - name: Added1015 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11105,7 +11105,7 @@ stage: Added - name: Added1016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11113,7 +11113,7 @@ stage: Added - name: Modified1017 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11121,7 +11121,7 @@ stage: Modified - name: Added1018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11129,7 +11129,7 @@ stage: Added - name: Added1019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11137,7 +11137,7 @@ stage: Added - name: Modified1020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11145,7 +11145,7 @@ stage: Modified - name: Added1021 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11153,7 +11153,7 @@ stage: Added - name: Added1022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11161,7 +11161,7 @@ stage: Added - name: Modified1023 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11169,7 +11169,7 @@ stage: Modified - name: Added1024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11177,7 +11177,7 @@ stage: Added - name: Added1025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11185,7 +11185,7 @@ stage: Added - name: Added1026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11193,7 +11193,7 @@ stage: Added - name: Added1027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11201,7 +11201,7 @@ stage: Added - name: Added1028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11209,7 +11209,7 @@ stage: Added - name: Added1029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11217,7 +11217,7 @@ stage: Added - name: Added1030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11225,7 +11225,7 @@ stage: Added - name: Added1031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11233,7 +11233,7 @@ stage: Added - name: Added1032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11241,7 +11241,7 @@ stage: Added - name: Added1033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11249,7 +11249,7 @@ stage: Added - name: Added1034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11257,7 +11257,7 @@ stage: Added - name: Added1035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11265,7 +11265,7 @@ stage: Added - name: Added1036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11273,7 +11273,7 @@ stage: Added - name: Added1037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11281,7 +11281,7 @@ stage: Added - name: Added1038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -11289,7 +11289,7 @@ stage: Added - name: Added1039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11297,7 +11297,7 @@ stage: Added - name: Added1040 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11313,7 +11313,7 @@ stage: Added - name: Added1041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11321,7 +11321,7 @@ stage: Added - name: Modified1042 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11341,7 +11341,7 @@ stage: Modified - name: Added1043 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11357,7 +11357,7 @@ stage: Added - name: Added1044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11365,7 +11365,7 @@ stage: Added - name: Modified1045 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11385,7 +11385,7 @@ stage: Modified - name: Added1046 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11401,7 +11401,7 @@ stage: Added - name: Added1047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11409,7 +11409,7 @@ stage: Added - name: Modified1048 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11429,7 +11429,7 @@ stage: Modified - name: Added1049 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11445,7 +11445,7 @@ stage: Added - name: Added1050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11453,7 +11453,7 @@ stage: Added - name: Modified1051 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11473,7 +11473,7 @@ stage: Modified - name: Added1052 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11489,7 +11489,7 @@ stage: Added - name: Added1053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11497,7 +11497,7 @@ stage: Added - name: Modified1054 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11517,7 +11517,7 @@ stage: Modified - name: Added1055 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11533,7 +11533,7 @@ stage: Added - name: Added1056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11541,7 +11541,7 @@ stage: Added - name: Modified1057 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11561,7 +11561,7 @@ stage: Modified - name: Added1058 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11577,7 +11577,7 @@ stage: Added - name: Added1059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11585,7 +11585,7 @@ stage: Added - name: Modified1060 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11605,7 +11605,7 @@ stage: Modified - name: Added1061 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11621,7 +11621,7 @@ stage: Added - name: Added1062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11629,7 +11629,7 @@ stage: Added - name: Modified1063 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11649,7 +11649,7 @@ stage: Modified - name: Added1064 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg424\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11664,7 +11664,7 @@ stage: Added - name: Added1065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg424\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg424\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11672,7 +11672,7 @@ stage: Added - name: Added1066 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg425\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11687,7 +11687,7 @@ stage: Added - name: Added1067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg425\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg425\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11695,7 +11695,7 @@ stage: Added - name: Added1068 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg426\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11710,7 +11710,7 @@ stage: Added - name: Added1069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg426\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg426\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11718,7 +11718,7 @@ stage: Added - name: Added1070 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg427\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11733,7 +11733,7 @@ stage: Added - name: Added1071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg427\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg427\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11741,7 +11741,7 @@ stage: Added - name: Added1072 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg428\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11756,7 +11756,7 @@ stage: Added - name: Added1073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg428\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg428\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11764,7 +11764,7 @@ stage: Added - name: Added1074 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg429\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11779,7 +11779,7 @@ stage: Added - name: Added1075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg429\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg429\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11787,7 +11787,7 @@ stage: Added - name: Added1076 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg430\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11802,7 +11802,7 @@ stage: Added - name: Added1077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg430\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg430\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11810,7 +11810,7 @@ stage: Added - name: Added1078 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg431\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -11825,7 +11825,7 @@ stage: Added - name: Added1079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg431\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg431\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11833,7 +11833,7 @@ stage: Added - name: Added1080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11841,7 +11841,7 @@ stage: Added - name: Added1081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11849,7 +11849,7 @@ stage: Added - name: Modified1082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11857,7 +11857,7 @@ stage: Modified - name: Added1083 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11865,7 +11865,7 @@ stage: Added - name: Added1084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11873,7 +11873,7 @@ stage: Added - name: Modified1085 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11881,7 +11881,7 @@ stage: Modified - name: Added1086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11889,7 +11889,7 @@ stage: Added - name: Added1087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11897,7 +11897,7 @@ stage: Added - name: Modified1088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11905,7 +11905,7 @@ stage: Modified - name: Added1089 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11913,7 +11913,7 @@ stage: Added - name: Added1090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -11921,7 +11921,7 @@ stage: Added - name: Modified1091 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11929,7 +11929,7 @@ stage: Modified - name: Added1092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11937,7 +11937,7 @@ stage: Added - name: Added1093 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11945,7 +11945,7 @@ stage: Added - name: Modified1094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11953,7 +11953,7 @@ stage: Modified - name: Added1095 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11961,7 +11961,7 @@ stage: Added - name: Added1096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11969,7 +11969,7 @@ stage: Added - name: Modified1097 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11977,7 +11977,7 @@ stage: Modified - name: Added1098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -11985,7 +11985,7 @@ stage: Added - name: Added1099 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -11993,7 +11993,7 @@ stage: Added - name: Modified1100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -12001,7 +12001,7 @@ stage: Modified - name: Added1101 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -12009,7 +12009,7 @@ stage: Added - name: Added1102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12017,7 +12017,7 @@ stage: Added - name: Modified1103 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723045, @@ -12025,14 +12025,14 @@ stage: Modified - name: Added1104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12040,14 +12040,14 @@ stage: Added - name: Added1106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12055,14 +12055,14 @@ stage: Added - name: Added1108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12070,14 +12070,14 @@ stage: Added - name: Added1110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12085,14 +12085,14 @@ stage: Added - name: Added1112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12100,14 +12100,14 @@ stage: Added - name: Added1114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12115,14 +12115,14 @@ stage: Added - name: Added1116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12130,14 +12130,14 @@ stage: Added - name: Added1118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key", "arch": "[x64]", "timestamp": 1606769870, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12145,7 +12145,7 @@ stage: Added - name: Added1120 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12161,7 +12161,7 @@ stage: Added - name: Added1121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12169,7 +12169,7 @@ stage: Added - name: Modified1122 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12189,7 +12189,7 @@ stage: Modified - name: Added1123 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12205,7 +12205,7 @@ stage: Added - name: Added1124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12213,7 +12213,7 @@ stage: Added - name: Modified1125 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12233,7 +12233,7 @@ stage: Modified - name: Added1126 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12249,7 +12249,7 @@ stage: Added - name: Added1127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12257,7 +12257,7 @@ stage: Added - name: Modified1128 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12277,7 +12277,7 @@ stage: Modified - name: Added1129 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12293,7 +12293,7 @@ stage: Added - name: Added1130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12301,7 +12301,7 @@ stage: Added - name: Modified1131 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12321,7 +12321,7 @@ stage: Modified - name: Added1132 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12337,7 +12337,7 @@ stage: Added - name: Added1133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12345,7 +12345,7 @@ stage: Added - name: Modified1134 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12365,7 +12365,7 @@ stage: Modified - name: Added1135 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12381,7 +12381,7 @@ stage: Added - name: Added1136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12389,7 +12389,7 @@ stage: Added - name: Modified1137 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12409,7 +12409,7 @@ stage: Modified - name: Added1138 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12425,7 +12425,7 @@ stage: Added - name: Added1139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12433,7 +12433,7 @@ stage: Added - name: Modified1140 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12453,7 +12453,7 @@ stage: Modified - name: Added1141 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12469,7 +12469,7 @@ stage: Added - name: Added1142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12477,7 +12477,7 @@ stage: Added - name: Modified1143 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12497,7 +12497,7 @@ stage: Modified - name: Added1144 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg456\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12513,7 +12513,7 @@ stage: Added - name: Added1145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg456\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg456\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12521,7 +12521,7 @@ stage: Added - name: Added1146 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg457\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12537,7 +12537,7 @@ stage: Added - name: Added1147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg457\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg457\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12545,7 +12545,7 @@ stage: Added - name: Added1148 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg458\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12561,7 +12561,7 @@ stage: Added - name: Added1149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg458\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg458\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12569,7 +12569,7 @@ stage: Added - name: Added1150 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg459\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12585,7 +12585,7 @@ stage: Added - name: Added1151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg459\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg459\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12593,7 +12593,7 @@ stage: Added - name: Added1152 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg460\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12609,7 +12609,7 @@ stage: Added - name: Added1153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg460\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg460\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12617,7 +12617,7 @@ stage: Added - name: Added1154 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg461\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12633,7 +12633,7 @@ stage: Added - name: Added1155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg461\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg461\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12641,7 +12641,7 @@ stage: Added - name: Added1156 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg462\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769870,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12657,7 +12657,7 @@ stage: Added - name: Added1157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg462\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769870,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg462\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769870, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12665,7 +12665,7 @@ stage: Added - name: Added1158 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg463\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -12681,7 +12681,7 @@ stage: Added - name: Added1159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg463\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg463\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12689,7 +12689,7 @@ stage: Added - name: Added1160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12697,7 +12697,7 @@ stage: Added - name: Added1161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12705,7 +12705,7 @@ stage: Added - name: Modified1162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12713,7 +12713,7 @@ stage: Modified - name: Added1163 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12721,7 +12721,7 @@ stage: Added - name: Added1164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12729,7 +12729,7 @@ stage: Added - name: Modified1165 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12737,7 +12737,7 @@ stage: Modified - name: Added1166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12745,7 +12745,7 @@ stage: Added - name: Added1167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12753,7 +12753,7 @@ stage: Added - name: Modified1168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12761,7 +12761,7 @@ stage: Modified - name: Added1169 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12769,7 +12769,7 @@ stage: Added - name: Added1170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12777,7 +12777,7 @@ stage: Added - name: Modified1171 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12785,7 +12785,7 @@ stage: Modified - name: Added1172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12793,7 +12793,7 @@ stage: Added - name: Added1173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12801,7 +12801,7 @@ stage: Added - name: Modified1174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12809,7 +12809,7 @@ stage: Modified - name: Added1175 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12817,7 +12817,7 @@ stage: Added - name: Added1176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12825,7 +12825,7 @@ stage: Added - name: Modified1177 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12833,7 +12833,7 @@ stage: Modified - name: Added1178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12841,7 +12841,7 @@ stage: Added - name: Added1179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12849,7 +12849,7 @@ stage: Added - name: Modified1180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12857,7 +12857,7 @@ stage: Modified - name: Added1181 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12865,7 +12865,7 @@ stage: Added - name: Added1182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12873,7 +12873,7 @@ stage: Added - name: Modified1183 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"79990a41b8f4f1fa540122004fc0a9b775207734"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -12881,7 +12881,7 @@ stage: Modified - name: Added1184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg472\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg472\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -12889,7 +12889,7 @@ stage: Added - name: Added1185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg472\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg472\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12897,7 +12897,7 @@ stage: Added - name: Added1186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg473\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg473\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -12905,7 +12905,7 @@ stage: Added - name: Added1187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg473\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg473\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12913,7 +12913,7 @@ stage: Added - name: Added1188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg474\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg474\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -12921,7 +12921,7 @@ stage: Added - name: Added1189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg474\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg474\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12929,7 +12929,7 @@ stage: Added - name: Added1190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg475\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg475\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -12937,7 +12937,7 @@ stage: Added - name: Added1191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg475\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg475\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -12945,7 +12945,7 @@ stage: Added - name: Added1192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg476\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg476\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -12953,7 +12953,7 @@ stage: Added - name: Added1193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg476\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg476\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12961,7 +12961,7 @@ stage: Added - name: Added1194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg477\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg477\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -12969,7 +12969,7 @@ stage: Added - name: Added1195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg477\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg477\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12977,7 +12977,7 @@ stage: Added - name: Added1196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg478\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg478\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -12985,7 +12985,7 @@ stage: Added - name: Added1197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg478\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg478\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -12993,7 +12993,7 @@ stage: Added - name: Added1198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg479\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg479\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -13001,7 +13001,7 @@ stage: Added - name: Added1199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg479\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg479\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13009,7 +13009,7 @@ stage: Added - name: Added1200 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13024,7 +13024,7 @@ stage: Added - name: Added1201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13032,7 +13032,7 @@ stage: Added - name: Modified1202 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13051,7 +13051,7 @@ stage: Modified - name: Added1203 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13066,7 +13066,7 @@ stage: Added - name: Added1204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13074,7 +13074,7 @@ stage: Added - name: Modified1205 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13093,7 +13093,7 @@ stage: Modified - name: Added1206 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13108,7 +13108,7 @@ stage: Added - name: Added1207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13116,7 +13116,7 @@ stage: Added - name: Modified1208 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13135,7 +13135,7 @@ stage: Modified - name: Added1209 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13150,7 +13150,7 @@ stage: Added - name: Added1210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13158,7 +13158,7 @@ stage: Added - name: Modified1211 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13177,7 +13177,7 @@ stage: Modified - name: Added1212 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13192,7 +13192,7 @@ stage: Added - name: Added1213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13200,7 +13200,7 @@ stage: Added - name: Modified1214 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13219,7 +13219,7 @@ stage: Modified - name: Added1215 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13234,7 +13234,7 @@ stage: Added - name: Added1216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13242,7 +13242,7 @@ stage: Added - name: Modified1217 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13261,7 +13261,7 @@ stage: Modified - name: Added1218 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13276,7 +13276,7 @@ stage: Added - name: Added1219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13284,7 +13284,7 @@ stage: Added - name: Modified1220 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13303,7 +13303,7 @@ stage: Modified - name: Added1221 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13318,7 +13318,7 @@ stage: Added - name: Added1222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13326,7 +13326,7 @@ stage: Added - name: Modified1223 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13345,7 +13345,7 @@ stage: Modified - name: Added1224 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg488\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13360,7 +13360,7 @@ stage: Added - name: Added1225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg488\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg488\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13368,7 +13368,7 @@ stage: Added - name: Added1226 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg489\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13383,7 +13383,7 @@ stage: Added - name: Added1227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg489\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg489\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13391,7 +13391,7 @@ stage: Added - name: Added1228 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg490\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13406,7 +13406,7 @@ stage: Added - name: Added1229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg490\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg490\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13414,7 +13414,7 @@ stage: Added - name: Added1230 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg491\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13429,7 +13429,7 @@ stage: Added - name: Added1231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg491\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg491\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13437,7 +13437,7 @@ stage: Added - name: Added1232 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg492\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13452,7 +13452,7 @@ stage: Added - name: Added1233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg492\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg492\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13460,7 +13460,7 @@ stage: Added - name: Added1234 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg493\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13475,7 +13475,7 @@ stage: Added - name: Added1235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg493\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg493\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13483,7 +13483,7 @@ stage: Added - name: Added1236 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg494\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13498,7 +13498,7 @@ stage: Added - name: Added1237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg494\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg494\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13506,7 +13506,7 @@ stage: Added - name: Added1238 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg495\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13521,7 +13521,7 @@ stage: Added - name: Added1239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg495\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg495\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13529,14 +13529,14 @@ stage: Added - name: Added1240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13544,21 +13544,21 @@ stage: Added - name: Modified1242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1243 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13566,21 +13566,21 @@ stage: Added - name: Modified1245 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13588,21 +13588,21 @@ stage: Added - name: Modified1248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1249 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13610,21 +13610,21 @@ stage: Added - name: Modified1251 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13632,21 +13632,21 @@ stage: Added - name: Modified1254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1255 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13654,21 +13654,21 @@ stage: Added - name: Modified1257 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13676,21 +13676,21 @@ stage: Added - name: Modified1260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1261 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13698,21 +13698,21 @@ stage: Added - name: Modified1263 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722879,"checksum":"9588b36211133373e17786aed92a92b97f286a48"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg504\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg504\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg504\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg504\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13720,14 +13720,14 @@ stage: Added - name: Added1266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg505\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg505\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg505\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg505\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13735,14 +13735,14 @@ stage: Added - name: Added1268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg506\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg506\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg506\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg506\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13750,14 +13750,14 @@ stage: Added - name: Added1270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg507\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg507\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg507\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg507\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -13765,14 +13765,14 @@ stage: Added - name: Added1272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg508\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg508\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg508\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg508\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13780,14 +13780,14 @@ stage: Added - name: Added1274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg509\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg509\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg509\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg509\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13795,14 +13795,14 @@ stage: Added - name: Added1276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg510\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg510\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg510\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg510\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13810,14 +13810,14 @@ stage: Added - name: Added1278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg511\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg511\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg511\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg511\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -13825,7 +13825,7 @@ stage: Added - name: Added1280 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13841,7 +13841,7 @@ stage: Added - name: Added1281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -13850,7 +13850,7 @@ stage: Added - name: Modified1282 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13870,7 +13870,7 @@ stage: Modified - name: Added1283 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13886,7 +13886,7 @@ stage: Added - name: Added1284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -13895,7 +13895,7 @@ stage: Added - name: Modified1285 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13915,7 +13915,7 @@ stage: Modified - name: Added1286 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13931,7 +13931,7 @@ stage: Added - name: Added1287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -13940,7 +13940,7 @@ stage: Added - name: Modified1288 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13960,7 +13960,7 @@ stage: Modified - name: Added1289 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -13976,7 +13976,7 @@ stage: Added - name: Added1290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -13985,7 +13985,7 @@ stage: Added - name: Modified1291 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14005,7 +14005,7 @@ stage: Modified - name: Added1292 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14021,7 +14021,7 @@ stage: Added - name: Added1293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14030,7 +14030,7 @@ stage: Added - name: Modified1294 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14050,7 +14050,7 @@ stage: Modified - name: Added1295 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14066,7 +14066,7 @@ stage: Added - name: Added1296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14075,7 +14075,7 @@ stage: Added - name: Modified1297 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14095,7 +14095,7 @@ stage: Modified - name: Added1298 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14111,7 +14111,7 @@ stage: Added - name: Added1299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14120,7 +14120,7 @@ stage: Added - name: Modified1300 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14140,7 +14140,7 @@ stage: Modified - name: Added1301 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14156,7 +14156,7 @@ stage: Added - name: Added1302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14165,7 +14165,7 @@ stage: Added - name: Modified1303 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14185,7 +14185,7 @@ stage: Modified - name: Added1304 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg520\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14201,7 +14201,7 @@ stage: Added - name: Added1305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg520\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg520\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14210,7 +14210,7 @@ stage: Added - name: Added1306 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg521\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14226,7 +14226,7 @@ stage: Added - name: Added1307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg521\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg521\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14235,7 +14235,7 @@ stage: Added - name: Added1308 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg522\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14251,7 +14251,7 @@ stage: Added - name: Added1309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg522\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg522\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14260,7 +14260,7 @@ stage: Added - name: Added1310 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg523\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14276,7 +14276,7 @@ stage: Added - name: Added1311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg523\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg523\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14285,7 +14285,7 @@ stage: Added - name: Added1312 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg524\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14301,7 +14301,7 @@ stage: Added - name: Added1313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg524\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg524\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14310,7 +14310,7 @@ stage: Added - name: Added1314 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg525\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14326,7 +14326,7 @@ stage: Added - name: Added1315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg525\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg525\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14335,7 +14335,7 @@ stage: Added - name: Added1316 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg526\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14351,7 +14351,7 @@ stage: Added - name: Added1317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg526\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg526\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14360,7 +14360,7 @@ stage: Added - name: Added1318 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg527\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14376,7 +14376,7 @@ stage: Added - name: Added1319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg527\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg527\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14385,7 +14385,7 @@ stage: Added - name: Added1320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14393,7 +14393,7 @@ stage: Added - name: Added1321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14402,7 +14402,7 @@ stage: Added - name: Modified1322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14410,7 +14410,7 @@ stage: Modified - name: Added1323 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14418,7 +14418,7 @@ stage: Added - name: Added1324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14427,7 +14427,7 @@ stage: Added - name: Modified1325 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14435,7 +14435,7 @@ stage: Modified - name: Added1326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14443,7 +14443,7 @@ stage: Added - name: Added1327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14452,7 +14452,7 @@ stage: Added - name: Modified1328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14460,7 +14460,7 @@ stage: Modified - name: Added1329 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14468,7 +14468,7 @@ stage: Added - name: Added1330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14477,7 +14477,7 @@ stage: Added - name: Modified1331 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14485,7 +14485,7 @@ stage: Modified - name: Added1332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14493,7 +14493,7 @@ stage: Added - name: Added1333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14502,7 +14502,7 @@ stage: Added - name: Modified1334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14510,7 +14510,7 @@ stage: Modified - name: Added1335 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14518,7 +14518,7 @@ stage: Added - name: Added1336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14527,7 +14527,7 @@ stage: Added - name: Modified1337 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14535,7 +14535,7 @@ stage: Modified - name: Added1338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14543,7 +14543,7 @@ stage: Added - name: Added1339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14552,7 +14552,7 @@ stage: Added - name: Modified1340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14560,7 +14560,7 @@ stage: Modified - name: Added1341 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14568,7 +14568,7 @@ stage: Added - name: Added1342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14577,7 +14577,7 @@ stage: Added - name: Modified1343 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722879,"checksum":"90c446c759e35f033032fe57f1e63dc151143d53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14585,7 +14585,7 @@ stage: Modified - name: Added1344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14593,7 +14593,7 @@ stage: Added - name: Added1345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14602,7 +14602,7 @@ stage: Added - name: Added1346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14610,7 +14610,7 @@ stage: Added - name: Added1347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14619,7 +14619,7 @@ stage: Added - name: Added1348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14627,7 +14627,7 @@ stage: Added - name: Added1349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14636,7 +14636,7 @@ stage: Added - name: Added1350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14644,7 +14644,7 @@ stage: Added - name: Added1351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14653,7 +14653,7 @@ stage: Added - name: Added1352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14661,7 +14661,7 @@ stage: Added - name: Added1353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14670,7 +14670,7 @@ stage: Added - name: Added1354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14678,7 +14678,7 @@ stage: Added - name: Added1355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14687,7 +14687,7 @@ stage: Added - name: Added1356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14695,7 +14695,7 @@ stage: Added - name: Added1357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14704,7 +14704,7 @@ stage: Added - name: Added1358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -14712,7 +14712,7 @@ stage: Added - name: Added1359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14721,7 +14721,7 @@ stage: Added - name: Added1360 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14737,7 +14737,7 @@ stage: Added - name: Added1361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14746,7 +14746,7 @@ stage: Added - name: Modified1362 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14766,7 +14766,7 @@ stage: Modified - name: Added1363 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14782,7 +14782,7 @@ stage: Added - name: Added1364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14791,7 +14791,7 @@ stage: Added - name: Modified1365 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14811,7 +14811,7 @@ stage: Modified - name: Added1366 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14827,7 +14827,7 @@ stage: Added - name: Added1367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14836,7 +14836,7 @@ stage: Added - name: Modified1368 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14856,7 +14856,7 @@ stage: Modified - name: Added1369 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14872,7 +14872,7 @@ stage: Added - name: Added1370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14881,7 +14881,7 @@ stage: Added - name: Modified1371 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14901,7 +14901,7 @@ stage: Modified - name: Added1372 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14917,7 +14917,7 @@ stage: Added - name: Added1373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14926,7 +14926,7 @@ stage: Added - name: Modified1374 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14946,7 +14946,7 @@ stage: Modified - name: Added1375 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14962,7 +14962,7 @@ stage: Added - name: Added1376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -14971,7 +14971,7 @@ stage: Added - name: Modified1377 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -14991,7 +14991,7 @@ stage: Modified - name: Added1378 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15007,7 +15007,7 @@ stage: Added - name: Added1379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15016,7 +15016,7 @@ stage: Added - name: Modified1380 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15036,7 +15036,7 @@ stage: Modified - name: Added1381 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15052,7 +15052,7 @@ stage: Added - name: Added1382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15061,7 +15061,7 @@ stage: Added - name: Modified1383 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15081,7 +15081,7 @@ stage: Modified - name: Added1384 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg552\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15096,7 +15096,7 @@ stage: Added - name: Added1385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg552\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg552\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15105,7 +15105,7 @@ stage: Added - name: Added1386 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg553\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15120,7 +15120,7 @@ stage: Added - name: Added1387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg553\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg553\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15129,7 +15129,7 @@ stage: Added - name: Added1388 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg554\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15144,7 +15144,7 @@ stage: Added - name: Added1389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg554\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg554\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15153,7 +15153,7 @@ stage: Added - name: Added1390 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg555\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15168,7 +15168,7 @@ stage: Added - name: Added1391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg555\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg555\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15177,7 +15177,7 @@ stage: Added - name: Added1392 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg556\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15192,7 +15192,7 @@ stage: Added - name: Added1393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg556\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg556\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15201,7 +15201,7 @@ stage: Added - name: Added1394 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg557\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15216,7 +15216,7 @@ stage: Added - name: Added1395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg557\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg557\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15225,7 +15225,7 @@ stage: Added - name: Added1396 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg558\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15240,7 +15240,7 @@ stage: Added - name: Added1397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg558\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg558\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15249,7 +15249,7 @@ stage: Added - name: Added1398 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg559\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15264,7 +15264,7 @@ stage: Added - name: Added1399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg559\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg559\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15273,7 +15273,7 @@ stage: Added - name: Added1400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15281,7 +15281,7 @@ stage: Added - name: Added1401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15290,7 +15290,7 @@ stage: Added - name: Modified1402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15298,7 +15298,7 @@ stage: Modified - name: Added1403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15306,7 +15306,7 @@ stage: Added - name: Added1404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15315,7 +15315,7 @@ stage: Added - name: Modified1405 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15323,7 +15323,7 @@ stage: Modified - name: Added1406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15331,7 +15331,7 @@ stage: Added - name: Added1407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15340,7 +15340,7 @@ stage: Added - name: Modified1408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15348,7 +15348,7 @@ stage: Modified - name: Added1409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15356,7 +15356,7 @@ stage: Added - name: Added1410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15365,7 +15365,7 @@ stage: Added - name: Modified1411 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15373,7 +15373,7 @@ stage: Modified - name: Added1412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15381,7 +15381,7 @@ stage: Added - name: Added1413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15390,7 +15390,7 @@ stage: Added - name: Modified1414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15398,7 +15398,7 @@ stage: Modified - name: Added1415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15406,7 +15406,7 @@ stage: Added - name: Added1416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15415,7 +15415,7 @@ stage: Added - name: Modified1417 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15423,7 +15423,7 @@ stage: Modified - name: Added1418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15431,7 +15431,7 @@ stage: Added - name: Added1419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15440,7 +15440,7 @@ stage: Added - name: Modified1420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15448,7 +15448,7 @@ stage: Modified - name: Added1421 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15456,7 +15456,7 @@ stage: Added - name: Added1422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15465,7 +15465,7 @@ stage: Added - name: Modified1423 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722879,"checksum":"f3b9f68def4c62487e81a90fa63061ac092218a4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723046, @@ -15473,14 +15473,14 @@ stage: Modified - name: Added1424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15489,14 +15489,14 @@ stage: Added - name: Added1426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15505,14 +15505,14 @@ stage: Added - name: Added1428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15521,14 +15521,14 @@ stage: Added - name: Added1430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15537,14 +15537,14 @@ stage: Added - name: Added1432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15553,14 +15553,14 @@ stage: Added - name: Added1434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15569,14 +15569,14 @@ stage: Added - name: Added1436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15585,14 +15585,14 @@ stage: Added - name: Added1438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15601,7 +15601,7 @@ stage: Added - name: Added1440 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15617,7 +15617,7 @@ stage: Added - name: Added1441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15626,7 +15626,7 @@ stage: Added - name: Modified1442 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15646,7 +15646,7 @@ stage: Modified - name: Added1443 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15662,7 +15662,7 @@ stage: Added - name: Added1444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15671,7 +15671,7 @@ stage: Added - name: Modified1445 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15691,7 +15691,7 @@ stage: Modified - name: Added1446 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15707,7 +15707,7 @@ stage: Added - name: Added1447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15716,7 +15716,7 @@ stage: Added - name: Modified1448 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15736,7 +15736,7 @@ stage: Modified - name: Added1449 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15752,7 +15752,7 @@ stage: Added - name: Added1450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15761,7 +15761,7 @@ stage: Added - name: Modified1451 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15781,7 +15781,7 @@ stage: Modified - name: Added1452 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15797,7 +15797,7 @@ stage: Added - name: Added1453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15806,7 +15806,7 @@ stage: Added - name: Modified1454 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15826,7 +15826,7 @@ stage: Modified - name: Added1455 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15842,7 +15842,7 @@ stage: Added - name: Added1456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15851,7 +15851,7 @@ stage: Added - name: Modified1457 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15871,7 +15871,7 @@ stage: Modified - name: Added1458 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15887,7 +15887,7 @@ stage: Added - name: Added1459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15896,7 +15896,7 @@ stage: Added - name: Modified1460 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15916,7 +15916,7 @@ stage: Modified - name: Added1461 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15932,7 +15932,7 @@ stage: Added - name: Added1462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15941,7 +15941,7 @@ stage: Added - name: Modified1463 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15961,7 +15961,7 @@ stage: Modified - name: Added1464 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg584\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -15977,7 +15977,7 @@ stage: Added - name: Added1465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg584\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg584\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -15986,7 +15986,7 @@ stage: Added - name: Added1466 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg585\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16002,7 +16002,7 @@ stage: Added - name: Added1467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg585\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg585\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16011,7 +16011,7 @@ stage: Added - name: Added1468 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg586\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16027,7 +16027,7 @@ stage: Added - name: Added1469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg586\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg586\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16036,7 +16036,7 @@ stage: Added - name: Added1470 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg587\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16052,7 +16052,7 @@ stage: Added - name: Added1471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg587\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg587\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16061,7 +16061,7 @@ stage: Added - name: Added1472 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg588\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16077,7 +16077,7 @@ stage: Added - name: Added1473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg588\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg588\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16086,7 +16086,7 @@ stage: Added - name: Added1474 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg589\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16102,7 +16102,7 @@ stage: Added - name: Added1475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg589\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg589\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16111,7 +16111,7 @@ stage: Added - name: Added1476 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg590\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16127,7 +16127,7 @@ stage: Added - name: Added1477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg590\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg590\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16136,7 +16136,7 @@ stage: Added - name: Added1478 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg591\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16152,7 +16152,7 @@ stage: Added - name: Added1479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg591\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg591\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16161,7 +16161,7 @@ stage: Added - name: Added1480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16169,7 +16169,7 @@ stage: Added - name: Added1481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16178,7 +16178,7 @@ stage: Added - name: Modified1482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16186,7 +16186,7 @@ stage: Modified - name: Added1483 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16194,7 +16194,7 @@ stage: Added - name: Added1484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16203,7 +16203,7 @@ stage: Added - name: Modified1485 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16211,7 +16211,7 @@ stage: Modified - name: Added1486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16219,7 +16219,7 @@ stage: Added - name: Added1487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16228,7 +16228,7 @@ stage: Added - name: Modified1488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16236,7 +16236,7 @@ stage: Modified - name: Added1489 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16244,7 +16244,7 @@ stage: Added - name: Added1490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16253,7 +16253,7 @@ stage: Added - name: Modified1491 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16261,7 +16261,7 @@ stage: Modified - name: Added1492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16269,7 +16269,7 @@ stage: Added - name: Added1493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16278,7 +16278,7 @@ stage: Added - name: Modified1494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16286,7 +16286,7 @@ stage: Modified - name: Added1495 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16294,7 +16294,7 @@ stage: Added - name: Added1496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16303,7 +16303,7 @@ stage: Added - name: Modified1497 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16311,7 +16311,7 @@ stage: Modified - name: Added1498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16319,7 +16319,7 @@ stage: Added - name: Added1499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16328,7 +16328,7 @@ stage: Added - name: Modified1500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16336,7 +16336,7 @@ stage: Modified - name: Added1501 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16344,7 +16344,7 @@ stage: Added - name: Added1502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16353,7 +16353,7 @@ stage: Added - name: Modified1503 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -16361,7 +16361,7 @@ stage: Modified - name: Added1504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg600\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg600\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -16369,7 +16369,7 @@ stage: Added - name: Added1505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg600\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg600\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16378,7 +16378,7 @@ stage: Added - name: Added1506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg601\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg601\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -16386,7 +16386,7 @@ stage: Added - name: Added1507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg601\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg601\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16395,7 +16395,7 @@ stage: Added - name: Added1508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg602\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg602\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -16403,7 +16403,7 @@ stage: Added - name: Added1509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg602\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg602\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16412,7 +16412,7 @@ stage: Added - name: Added1510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg603\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg603\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -16420,7 +16420,7 @@ stage: Added - name: Added1511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg603\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg603\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16429,7 +16429,7 @@ stage: Added - name: Added1512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg604\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg604\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -16437,7 +16437,7 @@ stage: Added - name: Added1513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg604\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg604\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16446,7 +16446,7 @@ stage: Added - name: Added1514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg605\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg605\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -16454,7 +16454,7 @@ stage: Added - name: Added1515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg605\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg605\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16463,7 +16463,7 @@ stage: Added - name: Added1516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg606\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg606\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -16471,7 +16471,7 @@ stage: Added - name: Added1517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg606\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg606\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16480,7 +16480,7 @@ stage: Added - name: Added1518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg607\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg607\\reg_key", "arch": "[x64]", "timestamp": 1606769871, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -16488,7 +16488,7 @@ stage: Added - name: Added1519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg607\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg607\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16497,7 +16497,7 @@ stage: Added - name: Added1520 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16512,7 +16512,7 @@ stage: Added - name: Added1521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16521,7 +16521,7 @@ stage: Added - name: Modified1522 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16540,7 +16540,7 @@ stage: Modified - name: Added1523 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16555,7 +16555,7 @@ stage: Added - name: Added1524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16564,7 +16564,7 @@ stage: Added - name: Modified1525 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16583,7 +16583,7 @@ stage: Modified - name: Added1526 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16598,7 +16598,7 @@ stage: Added - name: Added1527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16607,7 +16607,7 @@ stage: Added - name: Modified1528 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16626,7 +16626,7 @@ stage: Modified - name: Added1529 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16641,7 +16641,7 @@ stage: Added - name: Added1530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16650,7 +16650,7 @@ stage: Added - name: Modified1531 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16669,7 +16669,7 @@ stage: Modified - name: Added1532 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16684,7 +16684,7 @@ stage: Added - name: Added1533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16693,7 +16693,7 @@ stage: Added - name: Modified1534 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16712,7 +16712,7 @@ stage: Modified - name: Added1535 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16727,7 +16727,7 @@ stage: Added - name: Added1536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16736,7 +16736,7 @@ stage: Added - name: Modified1537 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16755,7 +16755,7 @@ stage: Modified - name: Added1538 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16770,7 +16770,7 @@ stage: Added - name: Added1539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16779,7 +16779,7 @@ stage: Added - name: Modified1540 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16798,7 +16798,7 @@ stage: Modified - name: Added1541 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16813,7 +16813,7 @@ stage: Added - name: Added1542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16822,7 +16822,7 @@ stage: Added - name: Modified1543 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16841,7 +16841,7 @@ stage: Modified - name: Added1544 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg616\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16856,7 +16856,7 @@ stage: Added - name: Added1545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg616\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg616\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16865,7 +16865,7 @@ stage: Added - name: Added1546 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg617\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16880,7 +16880,7 @@ stage: Added - name: Added1547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg617\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg617\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16889,7 +16889,7 @@ stage: Added - name: Added1548 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg618\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16904,7 +16904,7 @@ stage: Added - name: Added1549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg618\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg618\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16913,7 +16913,7 @@ stage: Added - name: Added1550 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg619\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16928,7 +16928,7 @@ stage: Added - name: Added1551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg619\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg619\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16937,7 +16937,7 @@ stage: Added - name: Added1552 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg620\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16952,7 +16952,7 @@ stage: Added - name: Added1553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg620\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg620\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16961,7 +16961,7 @@ stage: Added - name: Added1554 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg621\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -16976,7 +16976,7 @@ stage: Added - name: Added1555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg621\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg621\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -16985,7 +16985,7 @@ stage: Added - name: Added1556 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg622\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769871,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17000,7 +17000,7 @@ stage: Added - name: Added1557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg622\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769871,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg622\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769871, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17009,7 +17009,7 @@ stage: Added - name: Added1558 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg623\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17024,7 +17024,7 @@ stage: Added - name: Added1559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg623\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg623\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17033,14 +17033,14 @@ stage: Added - name: Added1560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17049,21 +17049,21 @@ stage: Added - name: Modified1562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1563 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17072,21 +17072,21 @@ stage: Added - name: Modified1565 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17095,21 +17095,21 @@ stage: Added - name: Modified1568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1569 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17118,21 +17118,21 @@ stage: Added - name: Modified1571 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17141,21 +17141,21 @@ stage: Added - name: Modified1574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1575 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Added - name: Added1576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17164,21 +17164,21 @@ stage: Added - name: Modified1577 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723046, "checksum": "65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}' stage: Modified - name: Added1578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Added - name: Added1579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17187,21 +17187,21 @@ stage: Added - name: Modified1580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Modified - name: Added1581 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Added - name: Added1582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17210,21 +17210,21 @@ stage: Added - name: Modified1583 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Modified - name: Added1584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg632\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg632\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg632\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg632\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17233,14 +17233,14 @@ stage: Added - name: Added1586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg633\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg633\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg633\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg633\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17249,14 +17249,14 @@ stage: Added - name: Added1588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg634\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg634\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg634\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg634\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17265,14 +17265,14 @@ stage: Added - name: Added1590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg635\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg635\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg635\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg635\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17281,14 +17281,14 @@ stage: Added - name: Added1592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg636\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg636\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg636\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg636\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17297,14 +17297,14 @@ stage: Added - name: Added1594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg637\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg637\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg637\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg637\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17313,14 +17313,14 @@ stage: Added - name: Added1596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg638\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg638\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg638\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg638\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17329,14 +17329,14 @@ stage: Added - name: Added1598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg639\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg639\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg639\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg639\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17345,7 +17345,7 @@ stage: Added - name: Added1600 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17361,7 +17361,7 @@ stage: Added - name: Added1601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17370,7 +17370,7 @@ stage: Added - name: Modified1602 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17390,7 +17390,7 @@ stage: Modified - name: Added1603 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17406,7 +17406,7 @@ stage: Added - name: Added1604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17415,7 +17415,7 @@ stage: Added - name: Modified1605 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17435,7 +17435,7 @@ stage: Modified - name: Added1606 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17451,7 +17451,7 @@ stage: Added - name: Added1607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17460,7 +17460,7 @@ stage: Added - name: Modified1608 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17480,7 +17480,7 @@ stage: Modified - name: Added1609 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17496,7 +17496,7 @@ stage: Added - name: Added1610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17505,7 +17505,7 @@ stage: Added - name: Modified1611 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17525,7 +17525,7 @@ stage: Modified - name: Added1612 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17541,7 +17541,7 @@ stage: Added - name: Added1613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17550,7 +17550,7 @@ stage: Added - name: Modified1614 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17570,7 +17570,7 @@ stage: Modified - name: Added1615 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17586,7 +17586,7 @@ stage: Added - name: Added1616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17595,7 +17595,7 @@ stage: Added - name: Modified1617 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17615,7 +17615,7 @@ stage: Modified - name: Added1618 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17631,7 +17631,7 @@ stage: Added - name: Added1619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17640,7 +17640,7 @@ stage: Added - name: Modified1620 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17660,7 +17660,7 @@ stage: Modified - name: Added1621 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17676,7 +17676,7 @@ stage: Added - name: Added1622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17685,7 +17685,7 @@ stage: Added - name: Modified1623 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17705,7 +17705,7 @@ stage: Modified - name: Added1624 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg648\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17721,7 +17721,7 @@ stage: Added - name: Added1625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg648\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg648\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17730,7 +17730,7 @@ stage: Added - name: Added1626 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg649\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17746,7 +17746,7 @@ stage: Added - name: Added1627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg649\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg649\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17755,7 +17755,7 @@ stage: Added - name: Added1628 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg650\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17771,7 +17771,7 @@ stage: Added - name: Added1629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg650\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg650\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17780,7 +17780,7 @@ stage: Added - name: Added1630 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg651\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17796,7 +17796,7 @@ stage: Added - name: Added1631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg651\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg651\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17805,7 +17805,7 @@ stage: Added - name: Added1632 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg652\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17821,7 +17821,7 @@ stage: Added - name: Added1633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg652\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg652\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17830,7 +17830,7 @@ stage: Added - name: Added1634 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg653\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17846,7 +17846,7 @@ stage: Added - name: Added1635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg653\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg653\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17855,7 +17855,7 @@ stage: Added - name: Added1636 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg654\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17871,7 +17871,7 @@ stage: Added - name: Added1637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg654\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg654\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17880,7 +17880,7 @@ stage: Added - name: Added1638 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg655\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -17896,7 +17896,7 @@ stage: Added - name: Added1639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg655\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg655\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17905,7 +17905,7 @@ stage: Added - name: Added1640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -17913,7 +17913,7 @@ stage: Added - name: Added1641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17922,7 +17922,7 @@ stage: Added - name: Modified1642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -17930,7 +17930,7 @@ stage: Modified - name: Added1643 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -17938,7 +17938,7 @@ stage: Added - name: Added1644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17947,7 +17947,7 @@ stage: Added - name: Modified1645 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -17955,7 +17955,7 @@ stage: Modified - name: Added1646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -17963,7 +17963,7 @@ stage: Added - name: Added1647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17972,7 +17972,7 @@ stage: Added - name: Modified1648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -17980,7 +17980,7 @@ stage: Modified - name: Added1649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -17988,7 +17988,7 @@ stage: Added - name: Added1650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -17997,7 +17997,7 @@ stage: Added - name: Modified1651 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18005,7 +18005,7 @@ stage: Modified - name: Added1652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18013,7 +18013,7 @@ stage: Added - name: Added1653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18022,7 +18022,7 @@ stage: Added - name: Modified1654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18030,7 +18030,7 @@ stage: Modified - name: Added1655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18038,7 +18038,7 @@ stage: Added - name: Added1656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18047,7 +18047,7 @@ stage: Added - name: Modified1657 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18055,7 +18055,7 @@ stage: Modified - name: Added1658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18063,7 +18063,7 @@ stage: Added - name: Added1659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18072,7 +18072,7 @@ stage: Added - name: Modified1660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18080,7 +18080,7 @@ stage: Modified - name: Added1661 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18088,7 +18088,7 @@ stage: Added - name: Added1662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18097,7 +18097,7 @@ stage: Added - name: Modified1663 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18105,7 +18105,7 @@ stage: Modified - name: Added1664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18113,7 +18113,7 @@ stage: Added - name: Added1665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18122,7 +18122,7 @@ stage: Added - name: Added1666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18130,7 +18130,7 @@ stage: Added - name: Added1667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18139,7 +18139,7 @@ stage: Added - name: Added1668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18147,7 +18147,7 @@ stage: Added - name: Added1669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18156,7 +18156,7 @@ stage: Added - name: Added1670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18164,7 +18164,7 @@ stage: Added - name: Added1671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18173,7 +18173,7 @@ stage: Added - name: Added1672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18181,7 +18181,7 @@ stage: Added - name: Added1673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18190,7 +18190,7 @@ stage: Added - name: Added1674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18198,7 +18198,7 @@ stage: Added - name: Added1675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18207,7 +18207,7 @@ stage: Added - name: Added1676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18215,7 +18215,7 @@ stage: Added - name: Added1677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18224,7 +18224,7 @@ stage: Added - name: Added1678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -18232,7 +18232,7 @@ stage: Added - name: Added1679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18241,7 +18241,7 @@ stage: Added - name: Added1680 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18257,7 +18257,7 @@ stage: Added - name: Added1681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18266,7 +18266,7 @@ stage: Added - name: Modified1682 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18286,7 +18286,7 @@ stage: Modified - name: Added1683 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18302,7 +18302,7 @@ stage: Added - name: Added1684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18311,7 +18311,7 @@ stage: Added - name: Modified1685 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18331,7 +18331,7 @@ stage: Modified - name: Added1686 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18347,7 +18347,7 @@ stage: Added - name: Added1687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18356,7 +18356,7 @@ stage: Added - name: Modified1688 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18376,7 +18376,7 @@ stage: Modified - name: Added1689 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18392,7 +18392,7 @@ stage: Added - name: Added1690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18401,7 +18401,7 @@ stage: Added - name: Modified1691 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18421,7 +18421,7 @@ stage: Modified - name: Added1692 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18437,7 +18437,7 @@ stage: Added - name: Added1693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18446,7 +18446,7 @@ stage: Added - name: Modified1694 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18466,7 +18466,7 @@ stage: Modified - name: Added1695 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18482,7 +18482,7 @@ stage: Added - name: Added1696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18491,7 +18491,7 @@ stage: Added - name: Modified1697 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18511,7 +18511,7 @@ stage: Modified - name: Added1698 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18527,7 +18527,7 @@ stage: Added - name: Added1699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18536,7 +18536,7 @@ stage: Added - name: Modified1700 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18556,7 +18556,7 @@ stage: Modified - name: Added1701 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18572,7 +18572,7 @@ stage: Added - name: Added1702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18581,7 +18581,7 @@ stage: Added - name: Modified1703 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18601,7 +18601,7 @@ stage: Modified - name: Added1704 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg680\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18616,7 +18616,7 @@ stage: Added - name: Added1705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg680\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg680\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18625,7 +18625,7 @@ stage: Added - name: Added1706 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg681\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18640,7 +18640,7 @@ stage: Added - name: Added1707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg681\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg681\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18649,7 +18649,7 @@ stage: Added - name: Added1708 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg682\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18664,7 +18664,7 @@ stage: Added - name: Added1709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg682\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg682\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18673,7 +18673,7 @@ stage: Added - name: Added1710 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg683\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18688,7 +18688,7 @@ stage: Added - name: Added1711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg683\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg683\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18697,7 +18697,7 @@ stage: Added - name: Added1712 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg684\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18712,7 +18712,7 @@ stage: Added - name: Added1713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg684\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg684\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18721,7 +18721,7 @@ stage: Added - name: Added1714 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg685\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18736,7 +18736,7 @@ stage: Added - name: Added1715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg685\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg685\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18745,7 +18745,7 @@ stage: Added - name: Added1716 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg686\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18760,7 +18760,7 @@ stage: Added - name: Added1717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg686\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg686\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18769,7 +18769,7 @@ stage: Added - name: Added1718 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg687\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -18784,7 +18784,7 @@ stage: Added - name: Added1719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg687\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg687\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18793,7 +18793,7 @@ stage: Added - name: Added1720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18801,7 +18801,7 @@ stage: Added - name: Added1721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18810,7 +18810,7 @@ stage: Added - name: Modified1722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18818,7 +18818,7 @@ stage: Modified - name: Added1723 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18826,7 +18826,7 @@ stage: Added - name: Added1724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18835,7 +18835,7 @@ stage: Added - name: Modified1725 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18843,7 +18843,7 @@ stage: Modified - name: Added1726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18851,7 +18851,7 @@ stage: Added - name: Added1727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18860,7 +18860,7 @@ stage: Added - name: Modified1728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18868,7 +18868,7 @@ stage: Modified - name: Added1729 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18876,7 +18876,7 @@ stage: Added - name: Added1730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18885,7 +18885,7 @@ stage: Added - name: Modified1731 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18893,7 +18893,7 @@ stage: Modified - name: Added1732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18901,7 +18901,7 @@ stage: Added - name: Added1733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18910,7 +18910,7 @@ stage: Added - name: Modified1734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18918,7 +18918,7 @@ stage: Modified - name: Added1735 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18926,7 +18926,7 @@ stage: Added - name: Added1736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18935,7 +18935,7 @@ stage: Added - name: Modified1737 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18943,7 +18943,7 @@ stage: Modified - name: Added1738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18951,7 +18951,7 @@ stage: Added - name: Added1739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18960,7 +18960,7 @@ stage: Added - name: Modified1740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18968,7 +18968,7 @@ stage: Modified - name: Added1741 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18976,7 +18976,7 @@ stage: Added - name: Added1742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -18985,7 +18985,7 @@ stage: Added - name: Modified1743 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723047, @@ -18993,14 +18993,14 @@ stage: Modified - name: Added1744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19009,14 +19009,14 @@ stage: Added - name: Added1746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19025,14 +19025,14 @@ stage: Added - name: Added1748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19041,14 +19041,14 @@ stage: Added - name: Added1750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19057,14 +19057,14 @@ stage: Added - name: Added1752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19073,14 +19073,14 @@ stage: Added - name: Added1754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19089,14 +19089,14 @@ stage: Added - name: Added1756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19105,14 +19105,14 @@ stage: Added - name: Added1758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19121,7 +19121,7 @@ stage: Added - name: Added1760 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19137,7 +19137,7 @@ stage: Added - name: Added1761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19146,7 +19146,7 @@ stage: Added - name: Modified1762 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19166,7 +19166,7 @@ stage: Modified - name: Added1763 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19182,7 +19182,7 @@ stage: Added - name: Added1764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19191,7 +19191,7 @@ stage: Added - name: Modified1765 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19211,7 +19211,7 @@ stage: Modified - name: Added1766 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19227,7 +19227,7 @@ stage: Added - name: Added1767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19236,7 +19236,7 @@ stage: Added - name: Modified1768 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19256,7 +19256,7 @@ stage: Modified - name: Added1769 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19272,7 +19272,7 @@ stage: Added - name: Added1770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19281,7 +19281,7 @@ stage: Added - name: Modified1771 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19301,7 +19301,7 @@ stage: Modified - name: Added1772 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19317,7 +19317,7 @@ stage: Added - name: Added1773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19326,7 +19326,7 @@ stage: Added - name: Modified1774 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19346,7 +19346,7 @@ stage: Modified - name: Added1775 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19362,7 +19362,7 @@ stage: Added - name: Added1776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19371,7 +19371,7 @@ stage: Added - name: Modified1777 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19391,7 +19391,7 @@ stage: Modified - name: Added1778 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19407,7 +19407,7 @@ stage: Added - name: Added1779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19416,7 +19416,7 @@ stage: Added - name: Modified1780 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19436,7 +19436,7 @@ stage: Modified - name: Added1781 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19452,7 +19452,7 @@ stage: Added - name: Added1782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19461,7 +19461,7 @@ stage: Added - name: Modified1783 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19481,7 +19481,7 @@ stage: Modified - name: Added1784 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg712\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19497,7 +19497,7 @@ stage: Added - name: Added1785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg712\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg712\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19506,7 +19506,7 @@ stage: Added - name: Added1786 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg713\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19522,7 +19522,7 @@ stage: Added - name: Added1787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg713\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg713\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19531,7 +19531,7 @@ stage: Added - name: Added1788 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg714\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19547,7 +19547,7 @@ stage: Added - name: Added1789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg714\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg714\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19556,7 +19556,7 @@ stage: Added - name: Added1790 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg715\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19572,7 +19572,7 @@ stage: Added - name: Added1791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg715\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg715\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19581,7 +19581,7 @@ stage: Added - name: Added1792 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg716\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19597,7 +19597,7 @@ stage: Added - name: Added1793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg716\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg716\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19606,7 +19606,7 @@ stage: Added - name: Added1794 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg717\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19622,7 +19622,7 @@ stage: Added - name: Added1795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg717\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg717\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19631,7 +19631,7 @@ stage: Added - name: Added1796 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg718\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19647,7 +19647,7 @@ stage: Added - name: Added1797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg718\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg718\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19656,7 +19656,7 @@ stage: Added - name: Added1798 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg719\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -19672,7 +19672,7 @@ stage: Added - name: Added1799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg719\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg719\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19681,7 +19681,7 @@ stage: Added - name: Added1800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19689,7 +19689,7 @@ stage: Added - name: Added1801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19698,7 +19698,7 @@ stage: Added - name: Modified1802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19706,7 +19706,7 @@ stage: Modified - name: Added1803 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19714,7 +19714,7 @@ stage: Added - name: Added1804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19723,7 +19723,7 @@ stage: Added - name: Modified1805 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19731,7 +19731,7 @@ stage: Modified - name: Added1806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19739,7 +19739,7 @@ stage: Added - name: Added1807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19748,7 +19748,7 @@ stage: Added - name: Modified1808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19756,7 +19756,7 @@ stage: Modified - name: Added1809 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19764,7 +19764,7 @@ stage: Added - name: Added1810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19773,7 +19773,7 @@ stage: Added - name: Modified1811 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19781,7 +19781,7 @@ stage: Modified - name: Added1812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19789,7 +19789,7 @@ stage: Added - name: Added1813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19798,7 +19798,7 @@ stage: Added - name: Modified1814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19806,7 +19806,7 @@ stage: Modified - name: Added1815 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19814,7 +19814,7 @@ stage: Added - name: Added1816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19823,7 +19823,7 @@ stage: Added - name: Modified1817 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19831,7 +19831,7 @@ stage: Modified - name: Added1818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19839,7 +19839,7 @@ stage: Added - name: Added1819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19848,7 +19848,7 @@ stage: Added - name: Modified1820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19856,7 +19856,7 @@ stage: Modified - name: Added1821 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19864,7 +19864,7 @@ stage: Added - name: Added1822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19873,7 +19873,7 @@ stage: Added - name: Modified1823 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -19881,7 +19881,7 @@ stage: Modified - name: Added1824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg728\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg728\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -19889,7 +19889,7 @@ stage: Added - name: Added1825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg728\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg728\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19898,7 +19898,7 @@ stage: Added - name: Added1826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg729\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg729\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -19906,7 +19906,7 @@ stage: Added - name: Added1827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg729\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg729\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19915,7 +19915,7 @@ stage: Added - name: Added1828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg730\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg730\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -19923,7 +19923,7 @@ stage: Added - name: Added1829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg730\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg730\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19932,7 +19932,7 @@ stage: Added - name: Added1830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg731\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg731\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -19940,7 +19940,7 @@ stage: Added - name: Added1831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg731\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg731\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19949,7 +19949,7 @@ stage: Added - name: Added1832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg732\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg732\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -19957,7 +19957,7 @@ stage: Added - name: Added1833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg732\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg732\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19966,7 +19966,7 @@ stage: Added - name: Added1834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg733\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg733\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -19974,7 +19974,7 @@ stage: Added - name: Added1835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg733\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg733\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -19983,7 +19983,7 @@ stage: Added - name: Added1836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg734\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg734\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -19991,7 +19991,7 @@ stage: Added - name: Added1837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg734\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg734\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20000,7 +20000,7 @@ stage: Added - name: Added1838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg735\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg735\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -20008,7 +20008,7 @@ stage: Added - name: Added1839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg735\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg735\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20017,7 +20017,7 @@ stage: Added - name: Added1840 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20032,7 +20032,7 @@ stage: Added - name: Added1841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20041,7 +20041,7 @@ stage: Added - name: Modified1842 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20060,7 +20060,7 @@ stage: Modified - name: Added1843 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20075,7 +20075,7 @@ stage: Added - name: Added1844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20084,7 +20084,7 @@ stage: Added - name: Modified1845 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20103,7 +20103,7 @@ stage: Modified - name: Added1846 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20118,7 +20118,7 @@ stage: Added - name: Added1847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20127,7 +20127,7 @@ stage: Added - name: Modified1848 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20146,7 +20146,7 @@ stage: Modified - name: Added1849 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20161,7 +20161,7 @@ stage: Added - name: Added1850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20170,7 +20170,7 @@ stage: Added - name: Modified1851 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20189,7 +20189,7 @@ stage: Modified - name: Added1852 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20204,7 +20204,7 @@ stage: Added - name: Added1853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20213,7 +20213,7 @@ stage: Added - name: Modified1854 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20232,7 +20232,7 @@ stage: Modified - name: Added1855 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20247,7 +20247,7 @@ stage: Added - name: Added1856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20256,7 +20256,7 @@ stage: Added - name: Modified1857 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20275,7 +20275,7 @@ stage: Modified - name: Added1858 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20290,7 +20290,7 @@ stage: Added - name: Added1859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20299,7 +20299,7 @@ stage: Added - name: Modified1860 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20318,7 +20318,7 @@ stage: Modified - name: Added1861 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20333,7 +20333,7 @@ stage: Added - name: Added1862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20342,7 +20342,7 @@ stage: Added - name: Modified1863 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20361,7 +20361,7 @@ stage: Modified - name: Added1864 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg744\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20376,7 +20376,7 @@ stage: Added - name: Added1865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg744\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg744\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20385,7 +20385,7 @@ stage: Added - name: Added1866 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg745\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20400,7 +20400,7 @@ stage: Added - name: Added1867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg745\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg745\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20409,7 +20409,7 @@ stage: Added - name: Added1868 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg746\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20424,7 +20424,7 @@ stage: Added - name: Added1869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg746\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg746\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20433,7 +20433,7 @@ stage: Added - name: Added1870 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg747\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20448,7 +20448,7 @@ stage: Added - name: Added1871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg747\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg747\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20457,7 +20457,7 @@ stage: Added - name: Added1872 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg748\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20472,7 +20472,7 @@ stage: Added - name: Added1873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg748\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg748\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20481,7 +20481,7 @@ stage: Added - name: Added1874 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg749\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20496,7 +20496,7 @@ stage: Added - name: Added1875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg749\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg749\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20505,7 +20505,7 @@ stage: Added - name: Added1876 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg750\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20520,7 +20520,7 @@ stage: Added - name: Added1877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg750\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg750\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20529,7 +20529,7 @@ stage: Added - name: Added1878 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg751\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20544,7 +20544,7 @@ stage: Added - name: Added1879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg751\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg751\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20553,14 +20553,14 @@ stage: Added - name: Added1880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Added - name: Added1881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20569,21 +20569,21 @@ stage: Added - name: Modified1882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Modified - name: Added1883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Added - name: Added1884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20592,21 +20592,21 @@ stage: Added - name: Modified1885 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Modified - name: Added1886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Added - name: Added1887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20615,21 +20615,21 @@ stage: Added - name: Modified1888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Modified - name: Added1889 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Added - name: Added1890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20638,21 +20638,21 @@ stage: Added - name: Modified1891 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Modified - name: Added1892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Added - name: Added1893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20661,21 +20661,21 @@ stage: Added - name: Modified1894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Modified - name: Added1895 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Added - name: Added1896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20684,21 +20684,21 @@ stage: Added - name: Modified1897 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Modified - name: Added1898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Added - name: Added1899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20707,21 +20707,21 @@ stage: Added - name: Modified1900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Modified - name: Added1901 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Added - name: Added1902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20730,21 +20730,21 @@ stage: Added - name: Modified1903 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "mtime": 1606723047, "checksum": "552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}' stage: Modified - name: Added1904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg760\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg760\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg760\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg760\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20753,14 +20753,14 @@ stage: Added - name: Added1906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg761\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg761\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg761\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg761\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20769,14 +20769,14 @@ stage: Added - name: Added1908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg762\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg762\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg762\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg762\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20785,14 +20785,14 @@ stage: Added - name: Added1910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg763\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg763\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg763\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg763\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20801,14 +20801,14 @@ stage: Added - name: Added1912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg764\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg764\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg764\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg764\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20817,14 +20817,14 @@ stage: Added - name: Added1914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg765\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg765\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg765\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg765\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20833,14 +20833,14 @@ stage: Added - name: Added1916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg766\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg766\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg766\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg766\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20849,14 +20849,14 @@ stage: Added - name: Added1918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg767\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg767\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg767\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg767\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20865,7 +20865,7 @@ stage: Added - name: Added1920 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20881,7 +20881,7 @@ stage: Added - name: Added1921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20889,7 +20889,7 @@ stage: Added - name: Modified1922 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20909,7 +20909,7 @@ stage: Modified - name: Added1923 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20925,7 +20925,7 @@ stage: Added - name: Added1924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20933,7 +20933,7 @@ stage: Added - name: Modified1925 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20953,7 +20953,7 @@ stage: Modified - name: Added1926 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20969,7 +20969,7 @@ stage: Added - name: Added1927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -20977,7 +20977,7 @@ stage: Added - name: Modified1928 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -20997,7 +20997,7 @@ stage: Modified - name: Added1929 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21013,7 +21013,7 @@ stage: Added - name: Added1930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21021,7 +21021,7 @@ stage: Added - name: Modified1931 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21041,7 +21041,7 @@ stage: Modified - name: Added1932 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21057,7 +21057,7 @@ stage: Added - name: Added1933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21065,7 +21065,7 @@ stage: Added - name: Modified1934 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21085,7 +21085,7 @@ stage: Modified - name: Added1935 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21101,7 +21101,7 @@ stage: Added - name: Added1936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21109,7 +21109,7 @@ stage: Added - name: Modified1937 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21129,7 +21129,7 @@ stage: Modified - name: Added1938 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21145,7 +21145,7 @@ stage: Added - name: Added1939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21153,7 +21153,7 @@ stage: Added - name: Modified1940 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21173,7 +21173,7 @@ stage: Modified - name: Added1941 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21189,7 +21189,7 @@ stage: Added - name: Added1942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21197,7 +21197,7 @@ stage: Added - name: Modified1943 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21217,7 +21217,7 @@ stage: Modified - name: Added1944 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg776\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21233,7 +21233,7 @@ stage: Added - name: Added1945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg776\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg776\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21241,7 +21241,7 @@ stage: Added - name: Added1946 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg777\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21257,7 +21257,7 @@ stage: Added - name: Added1947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg777\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg777\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21265,7 +21265,7 @@ stage: Added - name: Added1948 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg778\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21281,7 +21281,7 @@ stage: Added - name: Added1949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg778\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg778\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21289,7 +21289,7 @@ stage: Added - name: Added1950 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg779\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21305,7 +21305,7 @@ stage: Added - name: Added1951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg779\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg779\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21313,7 +21313,7 @@ stage: Added - name: Added1952 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg780\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21329,7 +21329,7 @@ stage: Added - name: Added1953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg780\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg780\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21337,7 +21337,7 @@ stage: Added - name: Added1954 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg781\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21353,7 +21353,7 @@ stage: Added - name: Added1955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg781\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg781\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21361,7 +21361,7 @@ stage: Added - name: Added1956 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg782\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21377,7 +21377,7 @@ stage: Added - name: Added1957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg782\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg782\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21385,7 +21385,7 @@ stage: Added - name: Added1958 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg783\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21401,7 +21401,7 @@ stage: Added - name: Added1959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg783\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg783\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21409,7 +21409,7 @@ stage: Added - name: Added1960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21417,7 +21417,7 @@ stage: Added - name: Added1961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21425,7 +21425,7 @@ stage: Added - name: Modified1962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21433,7 +21433,7 @@ stage: Modified - name: Added1963 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21441,7 +21441,7 @@ stage: Added - name: Added1964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21449,7 +21449,7 @@ stage: Added - name: Modified1965 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21457,7 +21457,7 @@ stage: Modified - name: Added1966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21465,7 +21465,7 @@ stage: Added - name: Added1967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21473,7 +21473,7 @@ stage: Added - name: Modified1968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21481,7 +21481,7 @@ stage: Modified - name: Added1969 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21489,7 +21489,7 @@ stage: Added - name: Added1970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21497,7 +21497,7 @@ stage: Added - name: Modified1971 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21505,7 +21505,7 @@ stage: Modified - name: Added1972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21513,7 +21513,7 @@ stage: Added - name: Added1973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21521,7 +21521,7 @@ stage: Added - name: Modified1974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21529,7 +21529,7 @@ stage: Modified - name: Added1975 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21537,7 +21537,7 @@ stage: Added - name: Added1976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21545,7 +21545,7 @@ stage: Added - name: Modified1977 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21553,7 +21553,7 @@ stage: Modified - name: Added1978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21561,7 +21561,7 @@ stage: Added - name: Added1979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21569,7 +21569,7 @@ stage: Added - name: Modified1980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21577,7 +21577,7 @@ stage: Modified - name: Added1981 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21585,7 +21585,7 @@ stage: Added - name: Added1982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21593,7 +21593,7 @@ stage: Added - name: Modified1983 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21601,7 +21601,7 @@ stage: Modified - name: Added1984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21609,7 +21609,7 @@ stage: Added - name: Added1985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21617,7 +21617,7 @@ stage: Added - name: Added1986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21625,7 +21625,7 @@ stage: Added - name: Added1987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21633,7 +21633,7 @@ stage: Added - name: Added1988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21641,7 +21641,7 @@ stage: Added - name: Added1989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21649,7 +21649,7 @@ stage: Added - name: Added1990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21657,7 +21657,7 @@ stage: Added - name: Added1991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21665,7 +21665,7 @@ stage: Added - name: Added1992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21673,7 +21673,7 @@ stage: Added - name: Added1993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21681,7 +21681,7 @@ stage: Added - name: Added1994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21689,7 +21689,7 @@ stage: Added - name: Added1995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21697,7 +21697,7 @@ stage: Added - name: Added1996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21705,7 +21705,7 @@ stage: Added - name: Added1997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21713,7 +21713,7 @@ stage: Added - name: Added1998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key", "arch": "[x64]", "timestamp": 1606769872, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -21721,7 +21721,7 @@ stage: Added - name: Added1999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21729,7 +21729,7 @@ stage: Added - name: Added2000 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21745,7 +21745,7 @@ stage: Added - name: Added2001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21753,7 +21753,7 @@ stage: Added - name: Modified2002 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21773,7 +21773,7 @@ stage: Modified - name: Added2003 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21789,7 +21789,7 @@ stage: Added - name: Added2004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21797,7 +21797,7 @@ stage: Added - name: Modified2005 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21817,7 +21817,7 @@ stage: Modified - name: Added2006 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21833,7 +21833,7 @@ stage: Added - name: Added2007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21841,7 +21841,7 @@ stage: Added - name: Modified2008 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21861,7 +21861,7 @@ stage: Modified - name: Added2009 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21877,7 +21877,7 @@ stage: Added - name: Added2010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21885,7 +21885,7 @@ stage: Added - name: Modified2011 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21905,7 +21905,7 @@ stage: Modified - name: Added2012 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21921,7 +21921,7 @@ stage: Added - name: Added2013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21929,7 +21929,7 @@ stage: Added - name: Modified2014 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21949,7 +21949,7 @@ stage: Modified - name: Added2015 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21965,7 +21965,7 @@ stage: Added - name: Added2016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -21973,7 +21973,7 @@ stage: Added - name: Modified2017 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -21993,7 +21993,7 @@ stage: Modified - name: Added2018 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22009,7 +22009,7 @@ stage: Added - name: Added2019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22017,7 +22017,7 @@ stage: Added - name: Modified2020 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22037,7 +22037,7 @@ stage: Modified - name: Added2021 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22053,7 +22053,7 @@ stage: Added - name: Added2022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22061,7 +22061,7 @@ stage: Added - name: Modified2023 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22081,7 +22081,7 @@ stage: Modified - name: Added2024 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg808\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22096,7 +22096,7 @@ stage: Added - name: Added2025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg808\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg808\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22104,7 +22104,7 @@ stage: Added - name: Added2026 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg809\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769872,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22119,7 +22119,7 @@ stage: Added - name: Added2027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg809\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769872,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg809\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22127,7 +22127,7 @@ stage: Added - name: Added2028 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg810\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22142,7 +22142,7 @@ stage: Added - name: Added2029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg810\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg810\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22150,7 +22150,7 @@ stage: Added - name: Added2030 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg811\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22165,7 +22165,7 @@ stage: Added - name: Added2031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg811\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg811\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22173,7 +22173,7 @@ stage: Added - name: Added2032 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg812\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22188,7 +22188,7 @@ stage: Added - name: Added2033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg812\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg812\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22196,7 +22196,7 @@ stage: Added - name: Added2034 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg813\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22211,7 +22211,7 @@ stage: Added - name: Added2035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg813\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg813\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22219,7 +22219,7 @@ stage: Added - name: Added2036 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg814\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22234,7 +22234,7 @@ stage: Added - name: Added2037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg814\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg814\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22242,7 +22242,7 @@ stage: Added - name: Added2038 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg815\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22257,7 +22257,7 @@ stage: Added - name: Added2039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg815\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg815\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22265,7 +22265,7 @@ stage: Added - name: Added2040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22273,7 +22273,7 @@ stage: Added - name: Added2041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22281,7 +22281,7 @@ stage: Added - name: Modified2042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22289,7 +22289,7 @@ stage: Modified - name: Added2043 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22297,7 +22297,7 @@ stage: Added - name: Added2044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22305,7 +22305,7 @@ stage: Added - name: Modified2045 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22313,7 +22313,7 @@ stage: Modified - name: Added2046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22321,7 +22321,7 @@ stage: Added - name: Added2047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22329,7 +22329,7 @@ stage: Added - name: Modified2048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22337,7 +22337,7 @@ stage: Modified - name: Added2049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22345,7 +22345,7 @@ stage: Added - name: Added2050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22353,7 +22353,7 @@ stage: Added - name: Modified2051 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22361,7 +22361,7 @@ stage: Modified - name: Added2052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22369,7 +22369,7 @@ stage: Added - name: Added2053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22377,7 +22377,7 @@ stage: Added - name: Modified2054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22385,7 +22385,7 @@ stage: Modified - name: Added2055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22393,7 +22393,7 @@ stage: Added - name: Added2056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22401,7 +22401,7 @@ stage: Added - name: Modified2057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22409,7 +22409,7 @@ stage: Modified - name: Added2058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22417,7 +22417,7 @@ stage: Added - name: Added2059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22425,7 +22425,7 @@ stage: Added - name: Modified2060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22433,7 +22433,7 @@ stage: Modified - name: Added2061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22441,7 +22441,7 @@ stage: Added - name: Added2062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22449,7 +22449,7 @@ stage: Added - name: Modified2063 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -22457,14 +22457,14 @@ stage: Modified - name: Added2064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22472,14 +22472,14 @@ stage: Added - name: Added2066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22487,14 +22487,14 @@ stage: Added - name: Added2068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22502,14 +22502,14 @@ stage: Added - name: Added2070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22517,14 +22517,14 @@ stage: Added - name: Added2072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22532,14 +22532,14 @@ stage: Added - name: Added2074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22547,14 +22547,14 @@ stage: Added - name: Added2076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22562,14 +22562,14 @@ stage: Added - name: Added2078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22577,7 +22577,7 @@ stage: Added - name: Added2080 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22593,7 +22593,7 @@ stage: Added - name: Added2081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22601,7 +22601,7 @@ stage: Added - name: Modified2082 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22621,7 +22621,7 @@ stage: Modified - name: Added2083 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22637,7 +22637,7 @@ stage: Added - name: Added2084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22645,7 +22645,7 @@ stage: Added - name: Modified2085 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22665,7 +22665,7 @@ stage: Modified - name: Added2086 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22681,7 +22681,7 @@ stage: Added - name: Added2087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22689,7 +22689,7 @@ stage: Added - name: Modified2088 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22709,7 +22709,7 @@ stage: Modified - name: Added2089 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22725,7 +22725,7 @@ stage: Added - name: Added2090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22733,7 +22733,7 @@ stage: Added - name: Modified2091 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22753,7 +22753,7 @@ stage: Modified - name: Added2092 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22769,7 +22769,7 @@ stage: Added - name: Added2093 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22777,7 +22777,7 @@ stage: Added - name: Modified2094 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22797,7 +22797,7 @@ stage: Modified - name: Added2095 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22813,7 +22813,7 @@ stage: Added - name: Added2096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22821,7 +22821,7 @@ stage: Added - name: Modified2097 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22841,7 +22841,7 @@ stage: Modified - name: Added2098 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22857,7 +22857,7 @@ stage: Added - name: Added2099 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22865,7 +22865,7 @@ stage: Added - name: Modified2100 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22885,7 +22885,7 @@ stage: Modified - name: Added2101 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22901,7 +22901,7 @@ stage: Added - name: Added2102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22909,7 +22909,7 @@ stage: Added - name: Modified2103 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22929,7 +22929,7 @@ stage: Modified - name: Added2104 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg840\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22945,7 +22945,7 @@ stage: Added - name: Added2105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg840\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg840\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22953,7 +22953,7 @@ stage: Added - name: Added2106 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg841\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22969,7 +22969,7 @@ stage: Added - name: Added2107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg841\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg841\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -22977,7 +22977,7 @@ stage: Added - name: Added2108 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg842\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -22993,7 +22993,7 @@ stage: Added - name: Added2109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg842\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg842\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23001,7 +23001,7 @@ stage: Added - name: Added2110 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg843\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23017,7 +23017,7 @@ stage: Added - name: Added2111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg843\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg843\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23025,7 +23025,7 @@ stage: Added - name: Added2112 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg844\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23041,7 +23041,7 @@ stage: Added - name: Added2113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg844\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg844\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23049,7 +23049,7 @@ stage: Added - name: Added2114 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg845\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23065,7 +23065,7 @@ stage: Added - name: Added2115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg845\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg845\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23073,7 +23073,7 @@ stage: Added - name: Added2116 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg846\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23089,7 +23089,7 @@ stage: Added - name: Added2117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg846\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg846\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23097,7 +23097,7 @@ stage: Added - name: Added2118 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg847\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23113,7 +23113,7 @@ stage: Added - name: Added2119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg847\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg847\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23121,7 +23121,7 @@ stage: Added - name: Added2120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23129,7 +23129,7 @@ stage: Added - name: Added2121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23137,7 +23137,7 @@ stage: Added - name: Modified2122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23145,7 +23145,7 @@ stage: Modified - name: Added2123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23153,7 +23153,7 @@ stage: Added - name: Added2124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23161,7 +23161,7 @@ stage: Added - name: Modified2125 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23169,7 +23169,7 @@ stage: Modified - name: Added2126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23177,7 +23177,7 @@ stage: Added - name: Added2127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23185,7 +23185,7 @@ stage: Added - name: Modified2128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23193,7 +23193,7 @@ stage: Modified - name: Added2129 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23201,7 +23201,7 @@ stage: Added - name: Added2130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23209,7 +23209,7 @@ stage: Added - name: Modified2131 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23217,7 +23217,7 @@ stage: Modified - name: Added2132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23225,7 +23225,7 @@ stage: Added - name: Added2133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23233,7 +23233,7 @@ stage: Added - name: Modified2134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23241,7 +23241,7 @@ stage: Modified - name: Added2135 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23249,7 +23249,7 @@ stage: Added - name: Added2136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23257,7 +23257,7 @@ stage: Added - name: Modified2137 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23265,7 +23265,7 @@ stage: Modified - name: Added2138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23273,7 +23273,7 @@ stage: Added - name: Added2139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23281,7 +23281,7 @@ stage: Added - name: Modified2140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23289,7 +23289,7 @@ stage: Modified - name: Added2141 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23297,7 +23297,7 @@ stage: Added - name: Added2142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23305,7 +23305,7 @@ stage: Added - name: Modified2143 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b571b97e99b961b836e96f4c6879ec6983150995"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -23313,7 +23313,7 @@ stage: Modified - name: Added2144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg856\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg856\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -23321,7 +23321,7 @@ stage: Added - name: Added2145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg856\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg856\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23329,7 +23329,7 @@ stage: Added - name: Added2146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg857\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg857\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -23337,7 +23337,7 @@ stage: Added - name: Added2147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg857\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg857\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23345,7 +23345,7 @@ stage: Added - name: Added2148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg858\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg858\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -23353,7 +23353,7 @@ stage: Added - name: Added2149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg858\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg858\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23361,7 +23361,7 @@ stage: Added - name: Added2150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg859\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg859\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -23369,7 +23369,7 @@ stage: Added - name: Added2151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg859\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg859\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23377,7 +23377,7 @@ stage: Added - name: Added2152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg860\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg860\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -23385,7 +23385,7 @@ stage: Added - name: Added2153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg860\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg860\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23393,7 +23393,7 @@ stage: Added - name: Added2154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg861\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg861\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -23401,7 +23401,7 @@ stage: Added - name: Added2155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg861\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg861\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23409,7 +23409,7 @@ stage: Added - name: Added2156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg862\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg862\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -23417,7 +23417,7 @@ stage: Added - name: Added2157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg862\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg862\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23425,7 +23425,7 @@ stage: Added - name: Added2158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg863\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg863\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -23433,7 +23433,7 @@ stage: Added - name: Added2159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg863\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg863\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23441,7 +23441,7 @@ stage: Added - name: Added2160 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23456,7 +23456,7 @@ stage: Added - name: Added2161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23464,7 +23464,7 @@ stage: Added - name: Modified2162 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23483,7 +23483,7 @@ stage: Modified - name: Added2163 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23498,7 +23498,7 @@ stage: Added - name: Added2164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23506,7 +23506,7 @@ stage: Added - name: Modified2165 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23525,7 +23525,7 @@ stage: Modified - name: Added2166 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23540,7 +23540,7 @@ stage: Added - name: Added2167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23548,7 +23548,7 @@ stage: Added - name: Modified2168 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23567,7 +23567,7 @@ stage: Modified - name: Added2169 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23582,7 +23582,7 @@ stage: Added - name: Added2170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23590,7 +23590,7 @@ stage: Added - name: Modified2171 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23609,7 +23609,7 @@ stage: Modified - name: Added2172 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23624,7 +23624,7 @@ stage: Added - name: Added2173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23632,7 +23632,7 @@ stage: Added - name: Modified2174 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23651,7 +23651,7 @@ stage: Modified - name: Added2175 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23666,7 +23666,7 @@ stage: Added - name: Added2176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23674,7 +23674,7 @@ stage: Added - name: Modified2177 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23693,7 +23693,7 @@ stage: Modified - name: Added2178 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23708,7 +23708,7 @@ stage: Added - name: Added2179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23716,7 +23716,7 @@ stage: Added - name: Modified2180 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23735,7 +23735,7 @@ stage: Modified - name: Added2181 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23750,7 +23750,7 @@ stage: Added - name: Added2182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23758,7 +23758,7 @@ stage: Added - name: Modified2183 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23777,7 +23777,7 @@ stage: Modified - name: Added2184 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg872\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23792,7 +23792,7 @@ stage: Added - name: Added2185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg872\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg872\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23800,7 +23800,7 @@ stage: Added - name: Added2186 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg873\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23815,7 +23815,7 @@ stage: Added - name: Added2187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg873\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg873\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23823,7 +23823,7 @@ stage: Added - name: Added2188 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg874\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23838,7 +23838,7 @@ stage: Added - name: Added2189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg874\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg874\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23846,7 +23846,7 @@ stage: Added - name: Added2190 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg875\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23861,7 +23861,7 @@ stage: Added - name: Added2191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg875\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg875\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23869,7 +23869,7 @@ stage: Added - name: Added2192 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg876\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23884,7 +23884,7 @@ stage: Added - name: Added2193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg876\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg876\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23892,7 +23892,7 @@ stage: Added - name: Added2194 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg877\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23907,7 +23907,7 @@ stage: Added - name: Added2195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg877\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg877\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23915,7 +23915,7 @@ stage: Added - name: Added2196 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg878\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23930,7 +23930,7 @@ stage: Added - name: Added2197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg878\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg878\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23938,7 +23938,7 @@ stage: Added - name: Added2198 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg879\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -23953,7 +23953,7 @@ stage: Added - name: Added2199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg879\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg879\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23961,14 +23961,14 @@ stage: Added - name: Added2200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Added - name: Added2201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23976,21 +23976,21 @@ stage: Added - name: Modified2202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Modified - name: Added2203 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Added - name: Added2204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -23998,21 +23998,21 @@ stage: Added - name: Modified2205 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Modified - name: Added2206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Added - name: Added2207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24020,21 +24020,21 @@ stage: Added - name: Modified2208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Modified - name: Added2209 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Added - name: Added2210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24042,21 +24042,21 @@ stage: Added - name: Modified2211 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Modified - name: Added2212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Added - name: Added2213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24064,21 +24064,21 @@ stage: Added - name: Modified2214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Modified - name: Added2215 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Added - name: Added2216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24086,21 +24086,21 @@ stage: Added - name: Modified2217 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Modified - name: Added2218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Added - name: Added2219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24108,21 +24108,21 @@ stage: Added - name: Modified2220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Modified - name: Added2221 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Added - name: Added2222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24130,21 +24130,21 @@ stage: Added - name: Modified2223 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722880,"checksum":"175cd54f7fd3a189581a168a73595ac73cade8ed"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "mtime": 1606723048, "checksum": "69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}' stage: Modified - name: Added2224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg888\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg888\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg888\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg888\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24152,14 +24152,14 @@ stage: Added - name: Added2226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg889\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg889\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg889\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg889\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24167,14 +24167,14 @@ stage: Added - name: Added2228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg890\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg890\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg890\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg890\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24182,14 +24182,14 @@ stage: Added - name: Added2230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg891\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg891\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg891\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg891\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24197,14 +24197,14 @@ stage: Added - name: Added2232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg892\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg892\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg892\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg892\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24212,14 +24212,14 @@ stage: Added - name: Added2234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg893\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg893\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg893\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg893\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24227,14 +24227,14 @@ stage: Added - name: Added2236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg894\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg894\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg894\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg894\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24242,14 +24242,14 @@ stage: Added - name: Added2238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg895\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg895\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg895\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg895\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24257,7 +24257,7 @@ stage: Added - name: Added2240 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24273,7 +24273,7 @@ stage: Added - name: Added2241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24281,7 +24281,7 @@ stage: Added - name: Modified2242 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24301,7 +24301,7 @@ stage: Modified - name: Added2243 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24317,7 +24317,7 @@ stage: Added - name: Added2244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24325,7 +24325,7 @@ stage: Added - name: Modified2245 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24345,7 +24345,7 @@ stage: Modified - name: Added2246 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24361,7 +24361,7 @@ stage: Added - name: Added2247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24369,7 +24369,7 @@ stage: Added - name: Modified2248 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24389,7 +24389,7 @@ stage: Modified - name: Added2249 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24405,7 +24405,7 @@ stage: Added - name: Added2250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24413,7 +24413,7 @@ stage: Added - name: Modified2251 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24433,7 +24433,7 @@ stage: Modified - name: Added2252 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24449,7 +24449,7 @@ stage: Added - name: Added2253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24457,7 +24457,7 @@ stage: Added - name: Modified2254 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24477,7 +24477,7 @@ stage: Modified - name: Added2255 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24493,7 +24493,7 @@ stage: Added - name: Added2256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24501,7 +24501,7 @@ stage: Added - name: Modified2257 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24521,7 +24521,7 @@ stage: Modified - name: Added2258 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24537,7 +24537,7 @@ stage: Added - name: Added2259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24545,7 +24545,7 @@ stage: Added - name: Modified2260 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24565,7 +24565,7 @@ stage: Modified - name: Added2261 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24581,7 +24581,7 @@ stage: Added - name: Added2262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24589,7 +24589,7 @@ stage: Added - name: Modified2263 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24609,7 +24609,7 @@ stage: Modified - name: Added2264 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg904\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24625,7 +24625,7 @@ stage: Added - name: Added2265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg904\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg904\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24633,7 +24633,7 @@ stage: Added - name: Added2266 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg905\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24649,7 +24649,7 @@ stage: Added - name: Added2267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg905\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg905\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24657,7 +24657,7 @@ stage: Added - name: Added2268 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg906\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24673,7 +24673,7 @@ stage: Added - name: Added2269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg906\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg906\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24681,7 +24681,7 @@ stage: Added - name: Added2270 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg907\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24697,7 +24697,7 @@ stage: Added - name: Added2271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg907\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg907\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24705,7 +24705,7 @@ stage: Added - name: Added2272 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg908\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24721,7 +24721,7 @@ stage: Added - name: Added2273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg908\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg908\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24729,7 +24729,7 @@ stage: Added - name: Added2274 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg909\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24745,7 +24745,7 @@ stage: Added - name: Added2275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg909\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg909\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24753,7 +24753,7 @@ stage: Added - name: Added2276 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg910\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24769,7 +24769,7 @@ stage: Added - name: Added2277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg910\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg910\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24777,7 +24777,7 @@ stage: Added - name: Added2278 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg911\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -24793,7 +24793,7 @@ stage: Added - name: Added2279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg911\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg911\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24801,7 +24801,7 @@ stage: Added - name: Added2280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24809,7 +24809,7 @@ stage: Added - name: Added2281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24817,7 +24817,7 @@ stage: Added - name: Modified2282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24825,7 +24825,7 @@ stage: Modified - name: Added2283 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24833,7 +24833,7 @@ stage: Added - name: Added2284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24841,7 +24841,7 @@ stage: Added - name: Modified2285 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24849,7 +24849,7 @@ stage: Modified - name: Added2286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24857,7 +24857,7 @@ stage: Added - name: Added2287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24865,7 +24865,7 @@ stage: Added - name: Modified2288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24873,7 +24873,7 @@ stage: Modified - name: Added2289 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24881,7 +24881,7 @@ stage: Added - name: Added2290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24889,7 +24889,7 @@ stage: Added - name: Modified2291 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24897,7 +24897,7 @@ stage: Modified - name: Added2292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24905,7 +24905,7 @@ stage: Added - name: Added2293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24913,7 +24913,7 @@ stage: Added - name: Modified2294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24921,7 +24921,7 @@ stage: Modified - name: Added2295 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24929,7 +24929,7 @@ stage: Added - name: Added2296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24937,7 +24937,7 @@ stage: Added - name: Modified2297 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24945,7 +24945,7 @@ stage: Modified - name: Added2298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24953,7 +24953,7 @@ stage: Added - name: Added2299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24961,7 +24961,7 @@ stage: Added - name: Modified2300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24969,7 +24969,7 @@ stage: Modified - name: Added2301 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24977,7 +24977,7 @@ stage: Added - name: Added2302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -24985,7 +24985,7 @@ stage: Added - name: Modified2303 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722880,"checksum":"b9d6d23e2981b73e910ae0aec096ddc1bba02ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -24993,7 +24993,7 @@ stage: Modified - name: Added2304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -25001,7 +25001,7 @@ stage: Added - name: Added2305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25009,7 +25009,7 @@ stage: Added - name: Added2306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -25017,7 +25017,7 @@ stage: Added - name: Added2307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25025,7 +25025,7 @@ stage: Added - name: Added2308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -25033,7 +25033,7 @@ stage: Added - name: Added2309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25041,7 +25041,7 @@ stage: Added - name: Added2310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -25049,7 +25049,7 @@ stage: Added - name: Added2311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25057,7 +25057,7 @@ stage: Added - name: Added2312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -25065,7 +25065,7 @@ stage: Added - name: Added2313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25073,7 +25073,7 @@ stage: Added - name: Added2314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -25081,7 +25081,7 @@ stage: Added - name: Added2315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25089,7 +25089,7 @@ stage: Added - name: Added2316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -25097,7 +25097,7 @@ stage: Added - name: Added2317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25105,7 +25105,7 @@ stage: Added - name: Added2318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -25113,7 +25113,7 @@ stage: Added - name: Added2319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25121,7 +25121,7 @@ stage: Added - name: Added2320 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25137,7 +25137,7 @@ stage: Added - name: Added2321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25145,7 +25145,7 @@ stage: Added - name: Modified2322 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25165,7 +25165,7 @@ stage: Modified - name: Added2323 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25181,7 +25181,7 @@ stage: Added - name: Added2324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25189,7 +25189,7 @@ stage: Added - name: Modified2325 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25209,7 +25209,7 @@ stage: Modified - name: Added2326 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25225,7 +25225,7 @@ stage: Added - name: Added2327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25233,7 +25233,7 @@ stage: Added - name: Modified2328 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25253,7 +25253,7 @@ stage: Modified - name: Added2329 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25269,7 +25269,7 @@ stage: Added - name: Added2330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25277,7 +25277,7 @@ stage: Added - name: Modified2331 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25297,7 +25297,7 @@ stage: Modified - name: Added2332 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25313,7 +25313,7 @@ stage: Added - name: Added2333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25321,7 +25321,7 @@ stage: Added - name: Modified2334 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25341,7 +25341,7 @@ stage: Modified - name: Added2335 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25357,7 +25357,7 @@ stage: Added - name: Added2336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25365,7 +25365,7 @@ stage: Added - name: Modified2337 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25385,7 +25385,7 @@ stage: Modified - name: Added2338 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25401,7 +25401,7 @@ stage: Added - name: Added2339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25409,7 +25409,7 @@ stage: Added - name: Modified2340 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25429,7 +25429,7 @@ stage: Modified - name: Added2341 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25445,7 +25445,7 @@ stage: Added - name: Added2342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25453,7 +25453,7 @@ stage: Added - name: Modified2343 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25473,7 +25473,7 @@ stage: Modified - name: Added2344 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg936\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25488,7 +25488,7 @@ stage: Added - name: Added2345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg936\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg936\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25496,7 +25496,7 @@ stage: Added - name: Added2346 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg937\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25511,7 +25511,7 @@ stage: Added - name: Added2347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg937\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg937\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25519,7 +25519,7 @@ stage: Added - name: Added2348 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg938\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25534,7 +25534,7 @@ stage: Added - name: Added2349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg938\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg938\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25542,7 +25542,7 @@ stage: Added - name: Added2350 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg939\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25557,7 +25557,7 @@ stage: Added - name: Added2351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg939\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg939\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25565,7 +25565,7 @@ stage: Added - name: Added2352 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg940\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25580,7 +25580,7 @@ stage: Added - name: Added2353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg940\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg940\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25588,7 +25588,7 @@ stage: Added - name: Added2354 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg941\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25603,7 +25603,7 @@ stage: Added - name: Added2355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg941\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg941\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25611,7 +25611,7 @@ stage: Added - name: Added2356 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg942\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25626,7 +25626,7 @@ stage: Added - name: Added2357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg942\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg942\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25634,7 +25634,7 @@ stage: Added - name: Added2358 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg943\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25649,7 +25649,7 @@ stage: Added - name: Added2359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg943\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg943\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25657,7 +25657,7 @@ stage: Added - name: Added2360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -25665,7 +25665,7 @@ stage: Added - name: Added2361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25673,7 +25673,7 @@ stage: Added - name: Modified2362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -25681,7 +25681,7 @@ stage: Modified - name: Added2363 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -25689,7 +25689,7 @@ stage: Added - name: Added2364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25697,7 +25697,7 @@ stage: Added - name: Modified2365 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -25705,7 +25705,7 @@ stage: Modified - name: Added2366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -25713,7 +25713,7 @@ stage: Added - name: Added2367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25721,7 +25721,7 @@ stage: Added - name: Modified2368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723048, @@ -25729,7 +25729,7 @@ stage: Modified - name: Added2369 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -25737,7 +25737,7 @@ stage: Added - name: Added2370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25745,7 +25745,7 @@ stage: Added - name: Modified2371 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -25753,7 +25753,7 @@ stage: Modified - name: Added2372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -25761,7 +25761,7 @@ stage: Added - name: Added2373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25769,7 +25769,7 @@ stage: Added - name: Modified2374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722880,"checksum":"eca55da70a82a4f72b37877e751e7138c1a5388c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -25777,7 +25777,7 @@ stage: Modified - name: Added2375 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -25785,7 +25785,7 @@ stage: Added - name: Added2376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25793,7 +25793,7 @@ stage: Added - name: Modified2377 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -25801,7 +25801,7 @@ stage: Modified - name: Added2378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -25809,7 +25809,7 @@ stage: Added - name: Added2379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25817,7 +25817,7 @@ stage: Added - name: Modified2380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -25825,7 +25825,7 @@ stage: Modified - name: Added2381 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -25833,7 +25833,7 @@ stage: Added - name: Added2382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25841,7 +25841,7 @@ stage: Added - name: Modified2383 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -25849,14 +25849,14 @@ stage: Modified - name: Added2384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25864,14 +25864,14 @@ stage: Added - name: Added2386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25879,14 +25879,14 @@ stage: Added - name: Added2388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25894,14 +25894,14 @@ stage: Added - name: Added2390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25909,14 +25909,14 @@ stage: Added - name: Added2392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25924,14 +25924,14 @@ stage: Added - name: Added2394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25939,14 +25939,14 @@ stage: Added - name: Added2396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25954,14 +25954,14 @@ stage: Added - name: Added2398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key", "arch": "[x64]", "timestamp": 1606769873, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25969,7 +25969,7 @@ stage: Added - name: Added2400 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769873,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -25985,7 +25985,7 @@ stage: Added - name: Added2401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -25993,7 +25993,7 @@ stage: Added - name: Modified2402 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26013,7 +26013,7 @@ stage: Modified - name: Added2403 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26029,7 +26029,7 @@ stage: Added - name: Added2404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26037,7 +26037,7 @@ stage: Added - name: Modified2405 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26057,7 +26057,7 @@ stage: Modified - name: Added2406 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26073,7 +26073,7 @@ stage: Added - name: Added2407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26081,7 +26081,7 @@ stage: Added - name: Modified2408 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26101,7 +26101,7 @@ stage: Modified - name: Added2409 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26117,7 +26117,7 @@ stage: Added - name: Added2410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26125,7 +26125,7 @@ stage: Added - name: Modified2411 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26145,7 +26145,7 @@ stage: Modified - name: Added2412 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26161,7 +26161,7 @@ stage: Added - name: Added2413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26169,7 +26169,7 @@ stage: Added - name: Modified2414 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26189,7 +26189,7 @@ stage: Modified - name: Added2415 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26205,7 +26205,7 @@ stage: Added - name: Added2416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26213,7 +26213,7 @@ stage: Added - name: Modified2417 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26233,7 +26233,7 @@ stage: Modified - name: Added2418 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26249,7 +26249,7 @@ stage: Added - name: Added2419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26257,7 +26257,7 @@ stage: Added - name: Modified2420 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26277,7 +26277,7 @@ stage: Modified - name: Added2421 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26293,7 +26293,7 @@ stage: Added - name: Added2422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26301,7 +26301,7 @@ stage: Added - name: Modified2423 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26321,7 +26321,7 @@ stage: Modified - name: Added2424 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg968\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26337,7 +26337,7 @@ stage: Added - name: Added2425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg968\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg968\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26345,7 +26345,7 @@ stage: Added - name: Added2426 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg969\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26361,7 +26361,7 @@ stage: Added - name: Added2427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg969\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg969\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26369,7 +26369,7 @@ stage: Added - name: Added2428 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg970\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26385,7 +26385,7 @@ stage: Added - name: Added2429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg970\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg970\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26393,7 +26393,7 @@ stage: Added - name: Added2430 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg971\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26409,7 +26409,7 @@ stage: Added - name: Added2431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg971\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg971\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26417,7 +26417,7 @@ stage: Added - name: Added2432 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg972\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26433,7 +26433,7 @@ stage: Added - name: Added2433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg972\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg972\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26441,7 +26441,7 @@ stage: Added - name: Added2434 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg973\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26457,7 +26457,7 @@ stage: Added - name: Added2435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg973\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg973\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26465,7 +26465,7 @@ stage: Added - name: Added2436 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg974\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26481,7 +26481,7 @@ stage: Added - name: Added2437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg974\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg974\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26489,7 +26489,7 @@ stage: Added - name: Added2438 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg975\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26505,7 +26505,7 @@ stage: Added - name: Added2439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg975\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg975\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26513,7 +26513,7 @@ stage: Added - name: Added2440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26521,7 +26521,7 @@ stage: Added - name: Added2441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26529,7 +26529,7 @@ stage: Added - name: Modified2442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26537,7 +26537,7 @@ stage: Modified - name: Added2443 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26545,7 +26545,7 @@ stage: Added - name: Added2444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26553,7 +26553,7 @@ stage: Added - name: Modified2445 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26561,7 +26561,7 @@ stage: Modified - name: Added2446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26569,7 +26569,7 @@ stage: Added - name: Added2447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26577,7 +26577,7 @@ stage: Added - name: Modified2448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26585,7 +26585,7 @@ stage: Modified - name: Added2449 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26593,7 +26593,7 @@ stage: Added - name: Added2450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26601,7 +26601,7 @@ stage: Added - name: Modified2451 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26609,7 +26609,7 @@ stage: Modified - name: Added2452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26617,7 +26617,7 @@ stage: Added - name: Added2453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26625,7 +26625,7 @@ stage: Added - name: Modified2454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26633,7 +26633,7 @@ stage: Modified - name: Added2455 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26641,7 +26641,7 @@ stage: Added - name: Added2456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26649,7 +26649,7 @@ stage: Added - name: Modified2457 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26657,7 +26657,7 @@ stage: Modified - name: Added2458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26665,7 +26665,7 @@ stage: Added - name: Added2459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26673,7 +26673,7 @@ stage: Added - name: Modified2460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26681,7 +26681,7 @@ stage: Modified - name: Added2461 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26689,7 +26689,7 @@ stage: Added - name: Added2462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26697,7 +26697,7 @@ stage: Added - name: Modified2463 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -26705,7 +26705,7 @@ stage: Modified - name: Added2464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg984\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg984\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -26713,7 +26713,7 @@ stage: Added - name: Added2465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg984\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg984\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26721,7 +26721,7 @@ stage: Added - name: Added2466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg985\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg985\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -26729,7 +26729,7 @@ stage: Added - name: Added2467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg985\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg985\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26737,7 +26737,7 @@ stage: Added - name: Added2468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg986\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg986\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -26745,7 +26745,7 @@ stage: Added - name: Added2469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg986\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg986\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26753,7 +26753,7 @@ stage: Added - name: Added2470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg987\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg987\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -26761,7 +26761,7 @@ stage: Added - name: Added2471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg987\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg987\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26769,7 +26769,7 @@ stage: Added - name: Added2472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg988\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg988\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -26777,7 +26777,7 @@ stage: Added - name: Added2473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg988\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg988\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26785,7 +26785,7 @@ stage: Added - name: Added2474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg989\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg989\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -26793,7 +26793,7 @@ stage: Added - name: Added2475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg989\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg989\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26801,7 +26801,7 @@ stage: Added - name: Added2476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg990\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg990\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -26809,7 +26809,7 @@ stage: Added - name: Added2477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg990\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg990\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26817,7 +26817,7 @@ stage: Added - name: Added2478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg991\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg991\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -26825,7 +26825,7 @@ stage: Added - name: Added2479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg991\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg991\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26833,7 +26833,7 @@ stage: Added - name: Added2480 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26848,7 +26848,7 @@ stage: Added - name: Added2481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26856,7 +26856,7 @@ stage: Added - name: Modified2482 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26875,7 +26875,7 @@ stage: Modified - name: Added2483 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26890,7 +26890,7 @@ stage: Added - name: Added2484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26898,7 +26898,7 @@ stage: Added - name: Modified2485 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26917,7 +26917,7 @@ stage: Modified - name: Added2486 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26932,7 +26932,7 @@ stage: Added - name: Added2487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26940,7 +26940,7 @@ stage: Added - name: Modified2488 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26959,7 +26959,7 @@ stage: Modified - name: Added2489 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -26974,7 +26974,7 @@ stage: Added - name: Added2490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -26982,7 +26982,7 @@ stage: Added - name: Modified2491 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27001,7 +27001,7 @@ stage: Modified - name: Added2492 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27016,7 +27016,7 @@ stage: Added - name: Added2493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27024,7 +27024,7 @@ stage: Added - name: Modified2494 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27043,7 +27043,7 @@ stage: Modified - name: Added2495 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27058,7 +27058,7 @@ stage: Added - name: Added2496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27066,7 +27066,7 @@ stage: Added - name: Modified2497 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27085,7 +27085,7 @@ stage: Modified - name: Added2498 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27100,7 +27100,7 @@ stage: Added - name: Added2499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27108,7 +27108,7 @@ stage: Added - name: Modified2500 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27127,7 +27127,7 @@ stage: Modified - name: Added2501 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27142,7 +27142,7 @@ stage: Added - name: Added2502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27150,7 +27150,7 @@ stage: Added - name: Modified2503 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27169,7 +27169,7 @@ stage: Modified - name: Added2504 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1000\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27184,7 +27184,7 @@ stage: Added - name: Added2505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1000\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1000\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27192,7 +27192,7 @@ stage: Added - name: Added2506 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1001\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27207,7 +27207,7 @@ stage: Added - name: Added2507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1001\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1001\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27215,7 +27215,7 @@ stage: Added - name: Added2508 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1002\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27230,7 +27230,7 @@ stage: Added - name: Added2509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1002\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1002\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27238,7 +27238,7 @@ stage: Added - name: Added2510 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1003\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27253,7 +27253,7 @@ stage: Added - name: Added2511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1003\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1003\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27261,7 +27261,7 @@ stage: Added - name: Added2512 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1004\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27276,7 +27276,7 @@ stage: Added - name: Added2513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1004\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1004\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27284,7 +27284,7 @@ stage: Added - name: Added2514 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1005\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27299,7 +27299,7 @@ stage: Added - name: Added2515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1005\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1005\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27307,7 +27307,7 @@ stage: Added - name: Added2516 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1006\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27322,7 +27322,7 @@ stage: Added - name: Added2517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1006\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1006\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27330,7 +27330,7 @@ stage: Added - name: Added2518 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1007\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27345,7 +27345,7 @@ stage: Added - name: Added2519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1007\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1007\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27353,14 +27353,14 @@ stage: Added - name: Added2520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Added - name: Added2521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27368,21 +27368,21 @@ stage: Added - name: Modified2522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Modified - name: Added2523 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Added - name: Added2524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27390,21 +27390,21 @@ stage: Added - name: Modified2525 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Modified - name: Added2526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Added - name: Added2527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27412,21 +27412,21 @@ stage: Added - name: Modified2528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Modified - name: Added2529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Added - name: Added2530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27434,21 +27434,21 @@ stage: Added - name: Modified2531 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Modified - name: Added2532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Added - name: Added2533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27456,21 +27456,21 @@ stage: Added - name: Modified2534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Modified - name: Added2535 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Added - name: Added2536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27478,21 +27478,21 @@ stage: Added - name: Modified2537 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Modified - name: Added2538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Added - name: Added2539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27500,21 +27500,21 @@ stage: Added - name: Modified2540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Modified - name: Added2541 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Added - name: Added2542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27522,21 +27522,21 @@ stage: Added - name: Modified2543 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "mtime": 1606723049, "checksum": "afb64885d606a63177f5440d2b43264870dfa59b"}}' stage: Modified - name: Added2544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1016\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1016\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1016\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1016\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27544,14 +27544,14 @@ stage: Added - name: Added2546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1017\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1017\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1017\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1017\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27559,14 +27559,14 @@ stage: Added - name: Added2548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1018\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1018\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1018\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1018\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27574,14 +27574,14 @@ stage: Added - name: Added2550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1019\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1019\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1019\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1019\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27589,14 +27589,14 @@ stage: Added - name: Added2552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1020\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1020\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1020\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1020\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27604,14 +27604,14 @@ stage: Added - name: Added2554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1021\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1021\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1021\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1021\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27619,14 +27619,14 @@ stage: Added - name: Added2556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1022\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1022\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1022\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1022\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27634,14 +27634,14 @@ stage: Added - name: Added2558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1023\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1023\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1023\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1023\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -27649,7 +27649,7 @@ stage: Added - name: Added2560 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27665,7 +27665,7 @@ stage: Added - name: Added2561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -27674,7 +27674,7 @@ stage: Added - name: Modified2562 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27694,7 +27694,7 @@ stage: Modified - name: Added2563 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27710,7 +27710,7 @@ stage: Added - name: Added2564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -27719,7 +27719,7 @@ stage: Added - name: Modified2565 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27739,7 +27739,7 @@ stage: Modified - name: Added2566 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27755,7 +27755,7 @@ stage: Added - name: Added2567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -27764,7 +27764,7 @@ stage: Added - name: Modified2568 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27784,7 +27784,7 @@ stage: Modified - name: Added2569 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27800,7 +27800,7 @@ stage: Added - name: Added2570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -27809,7 +27809,7 @@ stage: Added - name: Modified2571 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27829,7 +27829,7 @@ stage: Modified - name: Added2572 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27845,7 +27845,7 @@ stage: Added - name: Added2573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -27854,7 +27854,7 @@ stage: Added - name: Modified2574 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27874,7 +27874,7 @@ stage: Modified - name: Added2575 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27890,7 +27890,7 @@ stage: Added - name: Added2576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -27899,7 +27899,7 @@ stage: Added - name: Modified2577 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27919,7 +27919,7 @@ stage: Modified - name: Added2578 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27935,7 +27935,7 @@ stage: Added - name: Added2579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -27944,7 +27944,7 @@ stage: Added - name: Modified2580 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27964,7 +27964,7 @@ stage: Modified - name: Added2581 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -27980,7 +27980,7 @@ stage: Added - name: Added2582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -27989,7 +27989,7 @@ stage: Added - name: Modified2583 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28009,7 +28009,7 @@ stage: Modified - name: Added2584 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1032\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28025,7 +28025,7 @@ stage: Added - name: Added2585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1032\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1032\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28034,7 +28034,7 @@ stage: Added - name: Added2586 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1033\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28050,7 +28050,7 @@ stage: Added - name: Added2587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1033\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1033\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28059,7 +28059,7 @@ stage: Added - name: Added2588 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1034\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28075,7 +28075,7 @@ stage: Added - name: Added2589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1034\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1034\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28084,7 +28084,7 @@ stage: Added - name: Added2590 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1035\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28100,7 +28100,7 @@ stage: Added - name: Added2591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1035\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1035\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28109,7 +28109,7 @@ stage: Added - name: Added2592 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1036\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28125,7 +28125,7 @@ stage: Added - name: Added2593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1036\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1036\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28134,7 +28134,7 @@ stage: Added - name: Added2594 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1037\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28150,7 +28150,7 @@ stage: Added - name: Added2595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1037\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1037\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28159,7 +28159,7 @@ stage: Added - name: Added2596 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1038\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28175,7 +28175,7 @@ stage: Added - name: Added2597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1038\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1038\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28184,7 +28184,7 @@ stage: Added - name: Added2598 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1039\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28200,7 +28200,7 @@ stage: Added - name: Added2599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1039\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1039\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28209,7 +28209,7 @@ stage: Added - name: Added2600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28217,7 +28217,7 @@ stage: Added - name: Added2601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28226,7 +28226,7 @@ stage: Added - name: Modified2602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28234,7 +28234,7 @@ stage: Modified - name: Added2603 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28242,7 +28242,7 @@ stage: Added - name: Added2604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28251,7 +28251,7 @@ stage: Added - name: Modified2605 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28259,7 +28259,7 @@ stage: Modified - name: Added2606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28267,7 +28267,7 @@ stage: Added - name: Added2607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28276,7 +28276,7 @@ stage: Added - name: Modified2608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28284,7 +28284,7 @@ stage: Modified - name: Added2609 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28292,7 +28292,7 @@ stage: Added - name: Added2610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28301,7 +28301,7 @@ stage: Added - name: Modified2611 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28309,7 +28309,7 @@ stage: Modified - name: Added2612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28317,7 +28317,7 @@ stage: Added - name: Added2613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28326,7 +28326,7 @@ stage: Added - name: Modified2614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28334,7 +28334,7 @@ stage: Modified - name: Added2615 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28342,7 +28342,7 @@ stage: Added - name: Added2616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28351,7 +28351,7 @@ stage: Added - name: Modified2617 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28359,7 +28359,7 @@ stage: Modified - name: Added2618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28367,7 +28367,7 @@ stage: Added - name: Added2619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28376,7 +28376,7 @@ stage: Added - name: Modified2620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28384,7 +28384,7 @@ stage: Modified - name: Added2621 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28392,7 +28392,7 @@ stage: Added - name: Added2622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28401,7 +28401,7 @@ stage: Added - name: Modified2623 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28409,7 +28409,7 @@ stage: Modified - name: Added2624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28417,7 +28417,7 @@ stage: Added - name: Added2625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28426,7 +28426,7 @@ stage: Added - name: Added2626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28434,7 +28434,7 @@ stage: Added - name: Added2627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28443,7 +28443,7 @@ stage: Added - name: Added2628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28451,7 +28451,7 @@ stage: Added - name: Added2629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28460,7 +28460,7 @@ stage: Added - name: Added2630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28468,7 +28468,7 @@ stage: Added - name: Added2631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28477,7 +28477,7 @@ stage: Added - name: Added2632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28485,7 +28485,7 @@ stage: Added - name: Added2633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28494,7 +28494,7 @@ stage: Added - name: Added2634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28502,7 +28502,7 @@ stage: Added - name: Added2635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28511,7 +28511,7 @@ stage: Added - name: Added2636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28519,7 +28519,7 @@ stage: Added - name: Added2637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28528,7 +28528,7 @@ stage: Added - name: Added2638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -28536,7 +28536,7 @@ stage: Added - name: Added2639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28545,7 +28545,7 @@ stage: Added - name: Added2640 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28561,7 +28561,7 @@ stage: Added - name: Added2641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28570,7 +28570,7 @@ stage: Added - name: Modified2642 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28590,7 +28590,7 @@ stage: Modified - name: Added2643 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28606,7 +28606,7 @@ stage: Added - name: Added2644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28615,7 +28615,7 @@ stage: Added - name: Modified2645 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28635,7 +28635,7 @@ stage: Modified - name: Added2646 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28651,7 +28651,7 @@ stage: Added - name: Added2647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28660,7 +28660,7 @@ stage: Added - name: Modified2648 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28680,7 +28680,7 @@ stage: Modified - name: Added2649 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28696,7 +28696,7 @@ stage: Added - name: Added2650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28705,7 +28705,7 @@ stage: Added - name: Modified2651 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28725,7 +28725,7 @@ stage: Modified - name: Added2652 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28741,7 +28741,7 @@ stage: Added - name: Added2653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28750,7 +28750,7 @@ stage: Added - name: Modified2654 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28770,7 +28770,7 @@ stage: Modified - name: Added2655 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28786,7 +28786,7 @@ stage: Added - name: Added2656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28795,7 +28795,7 @@ stage: Added - name: Modified2657 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28815,7 +28815,7 @@ stage: Modified - name: Added2658 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28831,7 +28831,7 @@ stage: Added - name: Added2659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28840,7 +28840,7 @@ stage: Added - name: Modified2660 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28860,7 +28860,7 @@ stage: Modified - name: Added2661 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28876,7 +28876,7 @@ stage: Added - name: Added2662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28885,7 +28885,7 @@ stage: Added - name: Modified2663 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28905,7 +28905,7 @@ stage: Modified - name: Added2664 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1064\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28920,7 +28920,7 @@ stage: Added - name: Added2665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1064\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1064\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28929,7 +28929,7 @@ stage: Added - name: Added2666 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1065\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28944,7 +28944,7 @@ stage: Added - name: Added2667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1065\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1065\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28953,7 +28953,7 @@ stage: Added - name: Added2668 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1066\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28968,7 +28968,7 @@ stage: Added - name: Added2669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1066\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1066\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -28977,7 +28977,7 @@ stage: Added - name: Added2670 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1067\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -28992,7 +28992,7 @@ stage: Added - name: Added2671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1067\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1067\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29001,7 +29001,7 @@ stage: Added - name: Added2672 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1068\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29016,7 +29016,7 @@ stage: Added - name: Added2673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1068\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1068\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29025,7 +29025,7 @@ stage: Added - name: Added2674 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1069\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29040,7 +29040,7 @@ stage: Added - name: Added2675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1069\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1069\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29049,7 +29049,7 @@ stage: Added - name: Added2676 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1070\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29064,7 +29064,7 @@ stage: Added - name: Added2677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1070\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1070\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29073,7 +29073,7 @@ stage: Added - name: Added2678 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1071\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29088,7 +29088,7 @@ stage: Added - name: Added2679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1071\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1071\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29097,7 +29097,7 @@ stage: Added - name: Added2680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29105,7 +29105,7 @@ stage: Added - name: Added2681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29114,7 +29114,7 @@ stage: Added - name: Modified2682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29122,7 +29122,7 @@ stage: Modified - name: Added2683 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29130,7 +29130,7 @@ stage: Added - name: Added2684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29139,7 +29139,7 @@ stage: Added - name: Modified2685 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29147,7 +29147,7 @@ stage: Modified - name: Added2686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29155,7 +29155,7 @@ stage: Added - name: Added2687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29164,7 +29164,7 @@ stage: Added - name: Modified2688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29172,7 +29172,7 @@ stage: Modified - name: Added2689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29180,7 +29180,7 @@ stage: Added - name: Added2690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29189,7 +29189,7 @@ stage: Added - name: Modified2691 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29197,7 +29197,7 @@ stage: Modified - name: Added2692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29205,7 +29205,7 @@ stage: Added - name: Added2693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29214,7 +29214,7 @@ stage: Added - name: Modified2694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29222,7 +29222,7 @@ stage: Modified - name: Added2695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29230,7 +29230,7 @@ stage: Added - name: Added2696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29239,7 +29239,7 @@ stage: Added - name: Modified2697 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29247,7 +29247,7 @@ stage: Modified - name: Added2698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29255,7 +29255,7 @@ stage: Added - name: Added2699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29264,7 +29264,7 @@ stage: Added - name: Modified2700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29272,7 +29272,7 @@ stage: Modified - name: Added2701 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29280,7 +29280,7 @@ stage: Added - name: Added2702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29289,7 +29289,7 @@ stage: Added - name: Modified2703 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723049, @@ -29297,14 +29297,14 @@ stage: Modified - name: Added2704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29313,14 +29313,14 @@ stage: Added - name: Added2706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29329,14 +29329,14 @@ stage: Added - name: Added2708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29345,14 +29345,14 @@ stage: Added - name: Added2710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29361,14 +29361,14 @@ stage: Added - name: Added2712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29377,14 +29377,14 @@ stage: Added - name: Added2714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29393,14 +29393,14 @@ stage: Added - name: Added2716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29409,14 +29409,14 @@ stage: Added - name: Added2718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added2719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29425,7 +29425,7 @@ stage: Added - name: Added2720 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29441,7 +29441,7 @@ stage: Added - name: Added2721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29450,7 +29450,7 @@ stage: Added - name: Modified2722 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29470,7 +29470,7 @@ stage: Modified - name: Added2723 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29486,7 +29486,7 @@ stage: Added - name: Added2724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29495,7 +29495,7 @@ stage: Added - name: Modified2725 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29515,7 +29515,7 @@ stage: Modified - name: Added2726 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29531,7 +29531,7 @@ stage: Added - name: Added2727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29540,7 +29540,7 @@ stage: Added - name: Modified2728 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29560,7 +29560,7 @@ stage: Modified - name: Added2729 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29576,7 +29576,7 @@ stage: Added - name: Added2730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29585,7 +29585,7 @@ stage: Added - name: Modified2731 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29605,7 +29605,7 @@ stage: Modified - name: Added2732 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29621,7 +29621,7 @@ stage: Added - name: Added2733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29630,7 +29630,7 @@ stage: Added - name: Modified2734 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29650,7 +29650,7 @@ stage: Modified - name: Added2735 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29666,7 +29666,7 @@ stage: Added - name: Added2736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29675,7 +29675,7 @@ stage: Added - name: Modified2737 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29695,7 +29695,7 @@ stage: Modified - name: Added2738 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29711,7 +29711,7 @@ stage: Added - name: Added2739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29720,7 +29720,7 @@ stage: Added - name: Modified2740 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29740,7 +29740,7 @@ stage: Modified - name: Added2741 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29756,7 +29756,7 @@ stage: Added - name: Added2742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29765,7 +29765,7 @@ stage: Added - name: Modified2743 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29785,7 +29785,7 @@ stage: Modified - name: Added2744 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1096\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29801,7 +29801,7 @@ stage: Added - name: Added2745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1096\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1096\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29810,7 +29810,7 @@ stage: Added - name: Added2746 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1097\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29826,7 +29826,7 @@ stage: Added - name: Added2747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1097\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1097\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29835,7 +29835,7 @@ stage: Added - name: Added2748 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1098\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29851,7 +29851,7 @@ stage: Added - name: Added2749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1098\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1098\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29860,7 +29860,7 @@ stage: Added - name: Added2750 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1099\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29876,7 +29876,7 @@ stage: Added - name: Added2751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1099\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1099\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29885,7 +29885,7 @@ stage: Added - name: Added2752 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1100\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29901,7 +29901,7 @@ stage: Added - name: Added2753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1100\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1100\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29910,7 +29910,7 @@ stage: Added - name: Added2754 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1101\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29926,7 +29926,7 @@ stage: Added - name: Added2755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1101\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1101\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29935,7 +29935,7 @@ stage: Added - name: Added2756 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1102\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29951,7 +29951,7 @@ stage: Added - name: Added2757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1102\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1102\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29960,7 +29960,7 @@ stage: Added - name: Added2758 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1103\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -29976,7 +29976,7 @@ stage: Added - name: Added2759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1103\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1103\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -29985,7 +29985,7 @@ stage: Added - name: Added2760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -29993,7 +29993,7 @@ stage: Added - name: Added2761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30002,7 +30002,7 @@ stage: Added - name: Modified2762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30010,7 +30010,7 @@ stage: Modified - name: Added2763 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30018,7 +30018,7 @@ stage: Added - name: Added2764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30027,7 +30027,7 @@ stage: Added - name: Modified2765 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30035,7 +30035,7 @@ stage: Modified - name: Added2766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30043,7 +30043,7 @@ stage: Added - name: Added2767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30052,7 +30052,7 @@ stage: Added - name: Modified2768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30060,7 +30060,7 @@ stage: Modified - name: Added2769 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30068,7 +30068,7 @@ stage: Added - name: Added2770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30077,7 +30077,7 @@ stage: Added - name: Modified2771 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30085,7 +30085,7 @@ stage: Modified - name: Added2772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30093,7 +30093,7 @@ stage: Added - name: Added2773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30102,7 +30102,7 @@ stage: Added - name: Modified2774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30110,7 +30110,7 @@ stage: Modified - name: Added2775 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30118,7 +30118,7 @@ stage: Added - name: Added2776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30127,7 +30127,7 @@ stage: Added - name: Modified2777 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30135,7 +30135,7 @@ stage: Modified - name: Added2778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30143,7 +30143,7 @@ stage: Added - name: Added2779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30152,7 +30152,7 @@ stage: Added - name: Modified2780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30160,7 +30160,7 @@ stage: Modified - name: Added2781 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30168,7 +30168,7 @@ stage: Added - name: Added2782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30177,7 +30177,7 @@ stage: Added - name: Modified2783 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -30185,7 +30185,7 @@ stage: Modified - name: Added2784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1112\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1112\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -30193,7 +30193,7 @@ stage: Added - name: Added2785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1112\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1112\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30202,7 +30202,7 @@ stage: Added - name: Added2786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1113\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1113\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -30210,7 +30210,7 @@ stage: Added - name: Added2787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1113\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1113\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30219,7 +30219,7 @@ stage: Added - name: Added2788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1114\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1114\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -30227,7 +30227,7 @@ stage: Added - name: Added2789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1114\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1114\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30236,7 +30236,7 @@ stage: Added - name: Added2790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1115\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1115\\reg_key", "arch": "[x64]", "timestamp": 1606769874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -30244,7 +30244,7 @@ stage: Added - name: Added2791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1115\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769874,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1115\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30253,7 +30253,7 @@ stage: Added - name: Added2792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1116\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1116\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -30261,7 +30261,7 @@ stage: Added - name: Added2793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1116\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1116\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30270,7 +30270,7 @@ stage: Added - name: Added2794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1117\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1117\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -30278,7 +30278,7 @@ stage: Added - name: Added2795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1117\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1117\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30287,7 +30287,7 @@ stage: Added - name: Added2796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1118\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1118\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -30295,7 +30295,7 @@ stage: Added - name: Added2797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1118\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1118\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30304,7 +30304,7 @@ stage: Added - name: Added2798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1119\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1119\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -30312,7 +30312,7 @@ stage: Added - name: Added2799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1119\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1119\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30321,7 +30321,7 @@ stage: Added - name: Added2800 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30336,7 +30336,7 @@ stage: Added - name: Added2801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30345,7 +30345,7 @@ stage: Added - name: Modified2802 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30364,7 +30364,7 @@ stage: Modified - name: Added2803 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30379,7 +30379,7 @@ stage: Added - name: Added2804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30388,7 +30388,7 @@ stage: Added - name: Modified2805 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30407,7 +30407,7 @@ stage: Modified - name: Added2806 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30422,7 +30422,7 @@ stage: Added - name: Added2807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30431,7 +30431,7 @@ stage: Added - name: Modified2808 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30450,7 +30450,7 @@ stage: Modified - name: Added2809 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30465,7 +30465,7 @@ stage: Added - name: Added2810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30474,7 +30474,7 @@ stage: Added - name: Modified2811 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30493,7 +30493,7 @@ stage: Modified - name: Added2812 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30508,7 +30508,7 @@ stage: Added - name: Added2813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30517,7 +30517,7 @@ stage: Added - name: Modified2814 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30536,7 +30536,7 @@ stage: Modified - name: Added2815 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30551,7 +30551,7 @@ stage: Added - name: Added2816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30560,7 +30560,7 @@ stage: Added - name: Modified2817 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30579,7 +30579,7 @@ stage: Modified - name: Added2818 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30594,7 +30594,7 @@ stage: Added - name: Added2819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30603,7 +30603,7 @@ stage: Added - name: Modified2820 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30622,7 +30622,7 @@ stage: Modified - name: Added2821 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30637,7 +30637,7 @@ stage: Added - name: Added2822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30646,7 +30646,7 @@ stage: Added - name: Modified2823 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30665,7 +30665,7 @@ stage: Modified - name: Added2824 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1128\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30680,7 +30680,7 @@ stage: Added - name: Added2825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1128\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1128\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30689,7 +30689,7 @@ stage: Added - name: Added2826 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1129\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30704,7 +30704,7 @@ stage: Added - name: Added2827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1129\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1129\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30713,7 +30713,7 @@ stage: Added - name: Added2828 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1130\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30728,7 +30728,7 @@ stage: Added - name: Added2829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1130\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1130\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30737,7 +30737,7 @@ stage: Added - name: Added2830 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1131\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30752,7 +30752,7 @@ stage: Added - name: Added2831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1131\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1131\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30761,7 +30761,7 @@ stage: Added - name: Added2832 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1132\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30776,7 +30776,7 @@ stage: Added - name: Added2833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1132\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1132\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30785,7 +30785,7 @@ stage: Added - name: Added2834 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1133\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30800,7 +30800,7 @@ stage: Added - name: Added2835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1133\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1133\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30809,7 +30809,7 @@ stage: Added - name: Added2836 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1134\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30824,7 +30824,7 @@ stage: Added - name: Added2837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1134\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1134\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30833,7 +30833,7 @@ stage: Added - name: Added2838 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1135\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -30848,7 +30848,7 @@ stage: Added - name: Added2839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1135\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1135\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30857,14 +30857,14 @@ stage: Added - name: Added2840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added2841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30873,21 +30873,21 @@ stage: Added - name: Modified2842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added2843 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added2844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30896,21 +30896,21 @@ stage: Added - name: Modified2845 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added2846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added2847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30919,21 +30919,21 @@ stage: Added - name: Modified2848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added2849 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added2850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30942,21 +30942,21 @@ stage: Added - name: Modified2851 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added2852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added2853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30965,21 +30965,21 @@ stage: Added - name: Modified2854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added2855 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added2856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -30988,21 +30988,21 @@ stage: Added - name: Modified2857 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added2858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added2859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31011,21 +31011,21 @@ stage: Added - name: Modified2860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added2861 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added2862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31034,21 +31034,21 @@ stage: Added - name: Modified2863 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added2864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1144\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1144\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1144\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1144\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31057,14 +31057,14 @@ stage: Added - name: Added2866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1145\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1145\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1145\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1145\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31073,14 +31073,14 @@ stage: Added - name: Added2868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1146\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1146\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1146\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1146\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31089,14 +31089,14 @@ stage: Added - name: Added2870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1147\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1147\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1147\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1147\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31105,14 +31105,14 @@ stage: Added - name: Added2872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1148\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1148\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1148\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1148\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31121,14 +31121,14 @@ stage: Added - name: Added2874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1149\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1149\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1149\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1149\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31137,14 +31137,14 @@ stage: Added - name: Added2876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1150\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1150\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1150\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1150\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31153,14 +31153,14 @@ stage: Added - name: Added2878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1151\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1151\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1151\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1151\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31169,7 +31169,7 @@ stage: Added - name: Added2880 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31185,7 +31185,7 @@ stage: Added - name: Added2881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31194,7 +31194,7 @@ stage: Added - name: Modified2882 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31214,7 +31214,7 @@ stage: Modified - name: Added2883 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31230,7 +31230,7 @@ stage: Added - name: Added2884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31239,7 +31239,7 @@ stage: Added - name: Modified2885 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31259,7 +31259,7 @@ stage: Modified - name: Added2886 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31275,7 +31275,7 @@ stage: Added - name: Added2887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31284,7 +31284,7 @@ stage: Added - name: Modified2888 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31304,7 +31304,7 @@ stage: Modified - name: Added2889 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31320,7 +31320,7 @@ stage: Added - name: Added2890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31329,7 +31329,7 @@ stage: Added - name: Modified2891 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31349,7 +31349,7 @@ stage: Modified - name: Added2892 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31365,7 +31365,7 @@ stage: Added - name: Added2893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31374,7 +31374,7 @@ stage: Added - name: Modified2894 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31394,7 +31394,7 @@ stage: Modified - name: Added2895 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31410,7 +31410,7 @@ stage: Added - name: Added2896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31419,7 +31419,7 @@ stage: Added - name: Modified2897 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31439,7 +31439,7 @@ stage: Modified - name: Added2898 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31455,7 +31455,7 @@ stage: Added - name: Added2899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31464,7 +31464,7 @@ stage: Added - name: Modified2900 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31484,7 +31484,7 @@ stage: Modified - name: Added2901 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31500,7 +31500,7 @@ stage: Added - name: Added2902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31509,7 +31509,7 @@ stage: Added - name: Modified2903 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31529,7 +31529,7 @@ stage: Modified - name: Added2904 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1160\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31545,7 +31545,7 @@ stage: Added - name: Added2905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1160\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1160\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31554,7 +31554,7 @@ stage: Added - name: Added2906 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1161\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31570,7 +31570,7 @@ stage: Added - name: Added2907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1161\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1161\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31579,7 +31579,7 @@ stage: Added - name: Added2908 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1162\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31595,7 +31595,7 @@ stage: Added - name: Added2909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1162\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1162\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31604,7 +31604,7 @@ stage: Added - name: Added2910 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1163\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31620,7 +31620,7 @@ stage: Added - name: Added2911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1163\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1163\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31629,7 +31629,7 @@ stage: Added - name: Added2912 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1164\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31645,7 +31645,7 @@ stage: Added - name: Added2913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1164\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1164\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31654,7 +31654,7 @@ stage: Added - name: Added2914 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1165\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31670,7 +31670,7 @@ stage: Added - name: Added2915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1165\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1165\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31679,7 +31679,7 @@ stage: Added - name: Added2916 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1166\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31695,7 +31695,7 @@ stage: Added - name: Added2917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1166\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1166\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31704,7 +31704,7 @@ stage: Added - name: Added2918 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1167\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -31720,7 +31720,7 @@ stage: Added - name: Added2919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1167\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1167\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31729,7 +31729,7 @@ stage: Added - name: Added2920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31737,7 +31737,7 @@ stage: Added - name: Added2921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31746,7 +31746,7 @@ stage: Added - name: Modified2922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31754,7 +31754,7 @@ stage: Modified - name: Added2923 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31762,7 +31762,7 @@ stage: Added - name: Added2924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31771,7 +31771,7 @@ stage: Added - name: Modified2925 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31779,7 +31779,7 @@ stage: Modified - name: Added2926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31787,7 +31787,7 @@ stage: Added - name: Added2927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31796,7 +31796,7 @@ stage: Added - name: Modified2928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31804,7 +31804,7 @@ stage: Modified - name: Added2929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31812,7 +31812,7 @@ stage: Added - name: Added2930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31821,7 +31821,7 @@ stage: Added - name: Modified2931 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31829,7 +31829,7 @@ stage: Modified - name: Added2932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31837,7 +31837,7 @@ stage: Added - name: Added2933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31846,7 +31846,7 @@ stage: Added - name: Modified2934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31854,7 +31854,7 @@ stage: Modified - name: Added2935 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31862,7 +31862,7 @@ stage: Added - name: Added2936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31871,7 +31871,7 @@ stage: Added - name: Modified2937 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31879,7 +31879,7 @@ stage: Modified - name: Added2938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31887,7 +31887,7 @@ stage: Added - name: Added2939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31896,7 +31896,7 @@ stage: Added - name: Modified2940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31904,7 +31904,7 @@ stage: Modified - name: Added2941 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31912,7 +31912,7 @@ stage: Added - name: Added2942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -31921,7 +31921,7 @@ stage: Added - name: Modified2943 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31929,7 +31929,7 @@ stage: Modified - name: Added2944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31937,7 +31937,7 @@ stage: Added - name: Added2945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31946,7 +31946,7 @@ stage: Added - name: Added2946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31954,7 +31954,7 @@ stage: Added - name: Added2947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31963,7 +31963,7 @@ stage: Added - name: Added2948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31971,7 +31971,7 @@ stage: Added - name: Added2949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31980,7 +31980,7 @@ stage: Added - name: Added2950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -31988,7 +31988,7 @@ stage: Added - name: Added2951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -31997,7 +31997,7 @@ stage: Added - name: Added2952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -32005,7 +32005,7 @@ stage: Added - name: Added2953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32014,7 +32014,7 @@ stage: Added - name: Added2954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -32022,7 +32022,7 @@ stage: Added - name: Added2955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32031,7 +32031,7 @@ stage: Added - name: Added2956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -32039,7 +32039,7 @@ stage: Added - name: Added2957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32048,7 +32048,7 @@ stage: Added - name: Added2958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -32056,7 +32056,7 @@ stage: Added - name: Added2959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32065,7 +32065,7 @@ stage: Added - name: Added2960 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32081,7 +32081,7 @@ stage: Added - name: Added2961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32090,7 +32090,7 @@ stage: Added - name: Modified2962 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32110,7 +32110,7 @@ stage: Modified - name: Added2963 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32126,7 +32126,7 @@ stage: Added - name: Added2964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32135,7 +32135,7 @@ stage: Added - name: Modified2965 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32155,7 +32155,7 @@ stage: Modified - name: Added2966 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32171,7 +32171,7 @@ stage: Added - name: Added2967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32180,7 +32180,7 @@ stage: Added - name: Modified2968 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32200,7 +32200,7 @@ stage: Modified - name: Added2969 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32216,7 +32216,7 @@ stage: Added - name: Added2970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32225,7 +32225,7 @@ stage: Added - name: Modified2971 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32245,7 +32245,7 @@ stage: Modified - name: Added2972 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32261,7 +32261,7 @@ stage: Added - name: Added2973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32270,7 +32270,7 @@ stage: Added - name: Modified2974 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32290,7 +32290,7 @@ stage: Modified - name: Added2975 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32306,7 +32306,7 @@ stage: Added - name: Added2976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32315,7 +32315,7 @@ stage: Added - name: Modified2977 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32335,7 +32335,7 @@ stage: Modified - name: Added2978 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32351,7 +32351,7 @@ stage: Added - name: Added2979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32360,7 +32360,7 @@ stage: Added - name: Modified2980 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32380,7 +32380,7 @@ stage: Modified - name: Added2981 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32396,7 +32396,7 @@ stage: Added - name: Added2982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32405,7 +32405,7 @@ stage: Added - name: Modified2983 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32425,7 +32425,7 @@ stage: Modified - name: Added2984 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1192\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32440,7 +32440,7 @@ stage: Added - name: Added2985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1192\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1192\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32449,7 +32449,7 @@ stage: Added - name: Added2986 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1193\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32464,7 +32464,7 @@ stage: Added - name: Added2987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1193\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1193\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32473,7 +32473,7 @@ stage: Added - name: Added2988 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1194\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32488,7 +32488,7 @@ stage: Added - name: Added2989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1194\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1194\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32497,7 +32497,7 @@ stage: Added - name: Added2990 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1195\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32512,7 +32512,7 @@ stage: Added - name: Added2991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1195\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1195\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32521,7 +32521,7 @@ stage: Added - name: Added2992 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1196\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32536,7 +32536,7 @@ stage: Added - name: Added2993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1196\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1196\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32545,7 +32545,7 @@ stage: Added - name: Added2994 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1197\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32560,7 +32560,7 @@ stage: Added - name: Added2995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1197\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1197\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32569,7 +32569,7 @@ stage: Added - name: Added2996 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1198\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32584,7 +32584,7 @@ stage: Added - name: Added2997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1198\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1198\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32593,7 +32593,7 @@ stage: Added - name: Added2998 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1199\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32608,7 +32608,7 @@ stage: Added - name: Added2999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1199\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1199\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32617,7 +32617,7 @@ stage: Added - name: Added3000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32625,7 +32625,7 @@ stage: Added - name: Added3001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32634,7 +32634,7 @@ stage: Added - name: Modified3002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32642,7 +32642,7 @@ stage: Modified - name: Added3003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32650,7 +32650,7 @@ stage: Added - name: Added3004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32659,7 +32659,7 @@ stage: Added - name: Modified3005 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32667,7 +32667,7 @@ stage: Modified - name: Added3006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32675,7 +32675,7 @@ stage: Added - name: Added3007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32684,7 +32684,7 @@ stage: Added - name: Modified3008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32692,7 +32692,7 @@ stage: Modified - name: Added3009 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32700,7 +32700,7 @@ stage: Added - name: Added3010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32709,7 +32709,7 @@ stage: Added - name: Modified3011 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32717,7 +32717,7 @@ stage: Modified - name: Added3012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32725,7 +32725,7 @@ stage: Added - name: Added3013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32734,7 +32734,7 @@ stage: Added - name: Modified3014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32742,7 +32742,7 @@ stage: Modified - name: Added3015 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32750,7 +32750,7 @@ stage: Added - name: Added3016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32759,7 +32759,7 @@ stage: Added - name: Modified3017 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32767,7 +32767,7 @@ stage: Modified - name: Added3018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32775,7 +32775,7 @@ stage: Added - name: Added3019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32784,7 +32784,7 @@ stage: Added - name: Modified3020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32792,7 +32792,7 @@ stage: Modified - name: Added3021 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32800,7 +32800,7 @@ stage: Added - name: Added3022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32809,7 +32809,7 @@ stage: Added - name: Modified3023 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722881,"checksum":"7cc2a19b297fd184c2e065799934862fb16b5cd8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723050, @@ -32817,14 +32817,14 @@ stage: Modified - name: Added3024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32833,14 +32833,14 @@ stage: Added - name: Added3026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32849,14 +32849,14 @@ stage: Added - name: Added3028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32865,14 +32865,14 @@ stage: Added - name: Added3030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32881,14 +32881,14 @@ stage: Added - name: Added3032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32897,14 +32897,14 @@ stage: Added - name: Added3034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32913,14 +32913,14 @@ stage: Added - name: Added3036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32929,14 +32929,14 @@ stage: Added - name: Added3038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -32945,7 +32945,7 @@ stage: Added - name: Added3040 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32961,7 +32961,7 @@ stage: Added - name: Added3041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -32970,7 +32970,7 @@ stage: Added - name: Modified3042 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -32990,7 +32990,7 @@ stage: Modified - name: Added3043 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33006,7 +33006,7 @@ stage: Added - name: Added3044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33015,7 +33015,7 @@ stage: Added - name: Modified3045 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33035,7 +33035,7 @@ stage: Modified - name: Added3046 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33051,7 +33051,7 @@ stage: Added - name: Added3047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33060,7 +33060,7 @@ stage: Added - name: Modified3048 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33080,7 +33080,7 @@ stage: Modified - name: Added3049 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33096,7 +33096,7 @@ stage: Added - name: Added3050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33105,7 +33105,7 @@ stage: Added - name: Modified3051 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33125,7 +33125,7 @@ stage: Modified - name: Added3052 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33141,7 +33141,7 @@ stage: Added - name: Added3053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33150,7 +33150,7 @@ stage: Added - name: Modified3054 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33170,7 +33170,7 @@ stage: Modified - name: Added3055 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33186,7 +33186,7 @@ stage: Added - name: Added3056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33195,7 +33195,7 @@ stage: Added - name: Modified3057 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33215,7 +33215,7 @@ stage: Modified - name: Added3058 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33231,7 +33231,7 @@ stage: Added - name: Added3059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33240,7 +33240,7 @@ stage: Added - name: Modified3060 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33260,7 +33260,7 @@ stage: Modified - name: Added3061 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33276,7 +33276,7 @@ stage: Added - name: Added3062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33285,7 +33285,7 @@ stage: Added - name: Modified3063 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33305,7 +33305,7 @@ stage: Modified - name: Added3064 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1224\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33321,7 +33321,7 @@ stage: Added - name: Added3065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1224\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1224\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33330,7 +33330,7 @@ stage: Added - name: Added3066 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1225\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33346,7 +33346,7 @@ stage: Added - name: Added3067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1225\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1225\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33355,7 +33355,7 @@ stage: Added - name: Added3068 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1226\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33371,7 +33371,7 @@ stage: Added - name: Added3069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1226\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1226\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33380,7 +33380,7 @@ stage: Added - name: Added3070 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1227\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33396,7 +33396,7 @@ stage: Added - name: Added3071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1227\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1227\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33405,7 +33405,7 @@ stage: Added - name: Added3072 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1228\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33421,7 +33421,7 @@ stage: Added - name: Added3073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1228\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1228\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33430,7 +33430,7 @@ stage: Added - name: Added3074 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1229\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33446,7 +33446,7 @@ stage: Added - name: Added3075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1229\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1229\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33455,7 +33455,7 @@ stage: Added - name: Added3076 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1230\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33471,7 +33471,7 @@ stage: Added - name: Added3077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1230\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1230\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33480,7 +33480,7 @@ stage: Added - name: Added3078 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1231\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33496,7 +33496,7 @@ stage: Added - name: Added3079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1231\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1231\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33505,7 +33505,7 @@ stage: Added - name: Added3080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33513,7 +33513,7 @@ stage: Added - name: Added3081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33522,7 +33522,7 @@ stage: Added - name: Modified3082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33530,7 +33530,7 @@ stage: Modified - name: Added3083 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33538,7 +33538,7 @@ stage: Added - name: Added3084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33547,7 +33547,7 @@ stage: Added - name: Modified3085 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33555,7 +33555,7 @@ stage: Modified - name: Added3086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33563,7 +33563,7 @@ stage: Added - name: Added3087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33572,7 +33572,7 @@ stage: Added - name: Modified3088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33580,7 +33580,7 @@ stage: Modified - name: Added3089 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33588,7 +33588,7 @@ stage: Added - name: Added3090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33597,7 +33597,7 @@ stage: Added - name: Modified3091 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33605,7 +33605,7 @@ stage: Modified - name: Added3092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33613,7 +33613,7 @@ stage: Added - name: Added3093 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33622,7 +33622,7 @@ stage: Added - name: Modified3094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33630,7 +33630,7 @@ stage: Modified - name: Added3095 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33638,7 +33638,7 @@ stage: Added - name: Added3096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33647,7 +33647,7 @@ stage: Added - name: Modified3097 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33655,7 +33655,7 @@ stage: Modified - name: Added3098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33663,7 +33663,7 @@ stage: Added - name: Added3099 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33672,7 +33672,7 @@ stage: Added - name: Modified3100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33680,7 +33680,7 @@ stage: Modified - name: Added3101 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33688,7 +33688,7 @@ stage: Added - name: Added3102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33697,7 +33697,7 @@ stage: Added - name: Modified3103 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1c9a47bf264b7023778e3ad1a8c9bd6e36398690"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -33705,7 +33705,7 @@ stage: Modified - name: Added3104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1240\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1240\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -33713,7 +33713,7 @@ stage: Added - name: Added3105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1240\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1240\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33722,7 +33722,7 @@ stage: Added - name: Added3106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1241\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1241\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -33730,7 +33730,7 @@ stage: Added - name: Added3107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1241\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1241\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33739,7 +33739,7 @@ stage: Added - name: Added3108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1242\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1242\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -33747,7 +33747,7 @@ stage: Added - name: Added3109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1242\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1242\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33756,7 +33756,7 @@ stage: Added - name: Added3110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1243\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1243\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -33764,7 +33764,7 @@ stage: Added - name: Added3111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1243\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1243\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33773,7 +33773,7 @@ stage: Added - name: Added3112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1244\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1244\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -33781,7 +33781,7 @@ stage: Added - name: Added3113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1244\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1244\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33790,7 +33790,7 @@ stage: Added - name: Added3114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1245\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1245\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -33798,7 +33798,7 @@ stage: Added - name: Added3115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1245\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1245\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33807,7 +33807,7 @@ stage: Added - name: Added3116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1246\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1246\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -33815,7 +33815,7 @@ stage: Added - name: Added3117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1246\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1246\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33824,7 +33824,7 @@ stage: Added - name: Added3118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1247\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1247\\reg_key", "arch": "[x64]", "timestamp": 1606769875, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -33832,7 +33832,7 @@ stage: Added - name: Added3119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1247\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1247\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -33841,7 +33841,7 @@ stage: Added - name: Added3120 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33856,7 +33856,7 @@ stage: Added - name: Added3121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33865,7 +33865,7 @@ stage: Added - name: Modified3122 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33884,7 +33884,7 @@ stage: Modified - name: Added3123 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33899,7 +33899,7 @@ stage: Added - name: Added3124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33908,7 +33908,7 @@ stage: Added - name: Modified3125 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33927,7 +33927,7 @@ stage: Modified - name: Added3126 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33942,7 +33942,7 @@ stage: Added - name: Added3127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33951,7 +33951,7 @@ stage: Added - name: Modified3128 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33970,7 +33970,7 @@ stage: Modified - name: Added3129 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -33985,7 +33985,7 @@ stage: Added - name: Added3130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -33994,7 +33994,7 @@ stage: Added - name: Modified3131 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34013,7 +34013,7 @@ stage: Modified - name: Added3132 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34028,7 +34028,7 @@ stage: Added - name: Added3133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34037,7 +34037,7 @@ stage: Added - name: Modified3134 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34056,7 +34056,7 @@ stage: Modified - name: Added3135 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34071,7 +34071,7 @@ stage: Added - name: Added3136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34080,7 +34080,7 @@ stage: Added - name: Modified3137 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34099,7 +34099,7 @@ stage: Modified - name: Added3138 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34114,7 +34114,7 @@ stage: Added - name: Added3139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34123,7 +34123,7 @@ stage: Added - name: Modified3140 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34142,7 +34142,7 @@ stage: Modified - name: Added3141 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34157,7 +34157,7 @@ stage: Added - name: Added3142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34166,7 +34166,7 @@ stage: Added - name: Modified3143 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34185,7 +34185,7 @@ stage: Modified - name: Added3144 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1256\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34200,7 +34200,7 @@ stage: Added - name: Added3145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1256\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1256\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34209,7 +34209,7 @@ stage: Added - name: Added3146 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1257\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34224,7 +34224,7 @@ stage: Added - name: Added3147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1257\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1257\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34233,7 +34233,7 @@ stage: Added - name: Added3148 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1258\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34248,7 +34248,7 @@ stage: Added - name: Added3149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1258\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1258\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34257,7 +34257,7 @@ stage: Added - name: Added3150 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1259\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34272,7 +34272,7 @@ stage: Added - name: Added3151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1259\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1259\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34281,7 +34281,7 @@ stage: Added - name: Added3152 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1260\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34296,7 +34296,7 @@ stage: Added - name: Added3153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1260\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1260\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34305,7 +34305,7 @@ stage: Added - name: Added3154 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1261\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769875,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34320,7 +34320,7 @@ stage: Added - name: Added3155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1261\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769875,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1261\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769875, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34329,7 +34329,7 @@ stage: Added - name: Added3156 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1262\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34344,7 +34344,7 @@ stage: Added - name: Added3157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1262\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1262\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34353,7 +34353,7 @@ stage: Added - name: Added3158 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1263\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34368,7 +34368,7 @@ stage: Added - name: Added3159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1263\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1263\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34377,14 +34377,14 @@ stage: Added - name: Added3160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added3161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34393,21 +34393,21 @@ stage: Added - name: Modified3162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added3163 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added3164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34416,21 +34416,21 @@ stage: Added - name: Modified3165 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added3166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added3167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34439,21 +34439,21 @@ stage: Added - name: Modified3168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added3169 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added3170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34462,21 +34462,21 @@ stage: Added - name: Modified3171 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added3172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added3173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34485,21 +34485,21 @@ stage: Added - name: Modified3174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added3175 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added3176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34508,21 +34508,21 @@ stage: Added - name: Modified3177 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added3178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added3179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34531,21 +34531,21 @@ stage: Added - name: Modified3180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added3181 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Added - name: Added3182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34554,21 +34554,21 @@ stage: Added - name: Modified3183 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722881,"checksum":"f01ac0b71978fcba942c0c914f7eeb3f00697e53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723050, "checksum": "af8a218dff7360ccc41baff02a97f4326ed766a2"}}' stage: Modified - name: Added3184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1272\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1272\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1272\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1272\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34577,14 +34577,14 @@ stage: Added - name: Added3186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1273\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1273\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1273\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1273\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34593,14 +34593,14 @@ stage: Added - name: Added3188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1274\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1274\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1274\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1274\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34609,14 +34609,14 @@ stage: Added - name: Added3190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1275\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1275\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1275\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1275\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34625,14 +34625,14 @@ stage: Added - name: Added3192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1276\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1276\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1276\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1276\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34641,14 +34641,14 @@ stage: Added - name: Added3194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1277\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1277\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1277\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1277\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34657,14 +34657,14 @@ stage: Added - name: Added3196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1278\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1278\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1278\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1278\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34673,14 +34673,14 @@ stage: Added - name: Added3198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1279\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1279\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1279\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1279\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -34689,7 +34689,7 @@ stage: Added - name: Added3200 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34705,7 +34705,7 @@ stage: Added - name: Added3201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34713,7 +34713,7 @@ stage: Added - name: Modified3202 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34733,7 +34733,7 @@ stage: Modified - name: Added3203 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34749,7 +34749,7 @@ stage: Added - name: Added3204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34757,7 +34757,7 @@ stage: Added - name: Modified3205 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34777,7 +34777,7 @@ stage: Modified - name: Added3206 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34793,7 +34793,7 @@ stage: Added - name: Added3207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34801,7 +34801,7 @@ stage: Added - name: Modified3208 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34821,7 +34821,7 @@ stage: Modified - name: Added3209 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34837,7 +34837,7 @@ stage: Added - name: Added3210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34845,7 +34845,7 @@ stage: Added - name: Modified3211 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34865,7 +34865,7 @@ stage: Modified - name: Added3212 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34881,7 +34881,7 @@ stage: Added - name: Added3213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34889,7 +34889,7 @@ stage: Added - name: Modified3214 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34909,7 +34909,7 @@ stage: Modified - name: Added3215 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34925,7 +34925,7 @@ stage: Added - name: Added3216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34933,7 +34933,7 @@ stage: Added - name: Modified3217 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34953,7 +34953,7 @@ stage: Modified - name: Added3218 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34969,7 +34969,7 @@ stage: Added - name: Added3219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -34977,7 +34977,7 @@ stage: Added - name: Modified3220 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -34997,7 +34997,7 @@ stage: Modified - name: Added3221 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35013,7 +35013,7 @@ stage: Added - name: Added3222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35021,7 +35021,7 @@ stage: Added - name: Modified3223 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35041,7 +35041,7 @@ stage: Modified - name: Added3224 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1288\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35057,7 +35057,7 @@ stage: Added - name: Added3225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1288\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1288\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35065,7 +35065,7 @@ stage: Added - name: Added3226 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1289\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35081,7 +35081,7 @@ stage: Added - name: Added3227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1289\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1289\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35089,7 +35089,7 @@ stage: Added - name: Added3228 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1290\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35105,7 +35105,7 @@ stage: Added - name: Added3229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1290\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1290\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35113,7 +35113,7 @@ stage: Added - name: Added3230 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1291\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35129,7 +35129,7 @@ stage: Added - name: Added3231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1291\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1291\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35137,7 +35137,7 @@ stage: Added - name: Added3232 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1292\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35153,7 +35153,7 @@ stage: Added - name: Added3233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1292\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1292\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35161,7 +35161,7 @@ stage: Added - name: Added3234 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1293\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35177,7 +35177,7 @@ stage: Added - name: Added3235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1293\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1293\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35185,7 +35185,7 @@ stage: Added - name: Added3236 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1294\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35201,7 +35201,7 @@ stage: Added - name: Added3237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1294\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1294\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35209,7 +35209,7 @@ stage: Added - name: Added3238 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1295\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35225,7 +35225,7 @@ stage: Added - name: Added3239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1295\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1295\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35233,7 +35233,7 @@ stage: Added - name: Added3240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35241,7 +35241,7 @@ stage: Added - name: Added3241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35249,7 +35249,7 @@ stage: Added - name: Modified3242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35257,7 +35257,7 @@ stage: Modified - name: Added3243 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35265,7 +35265,7 @@ stage: Added - name: Added3244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35273,7 +35273,7 @@ stage: Added - name: Modified3245 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35281,7 +35281,7 @@ stage: Modified - name: Added3246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35289,7 +35289,7 @@ stage: Added - name: Added3247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35297,7 +35297,7 @@ stage: Added - name: Modified3248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35305,7 +35305,7 @@ stage: Modified - name: Added3249 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35313,7 +35313,7 @@ stage: Added - name: Added3250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35321,7 +35321,7 @@ stage: Added - name: Modified3251 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35329,7 +35329,7 @@ stage: Modified - name: Added3252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35337,7 +35337,7 @@ stage: Added - name: Added3253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35345,7 +35345,7 @@ stage: Added - name: Modified3254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35353,7 +35353,7 @@ stage: Modified - name: Added3255 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35361,7 +35361,7 @@ stage: Added - name: Added3256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35369,7 +35369,7 @@ stage: Added - name: Modified3257 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35377,7 +35377,7 @@ stage: Modified - name: Added3258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35385,7 +35385,7 @@ stage: Added - name: Added3259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35393,7 +35393,7 @@ stage: Added - name: Modified3260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35401,7 +35401,7 @@ stage: Modified - name: Added3261 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35409,7 +35409,7 @@ stage: Added - name: Added3262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35417,7 +35417,7 @@ stage: Added - name: Modified3263 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722881,"checksum":"1747d3e254f002eee2ac1294f3133e8dc0384079"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35425,7 +35425,7 @@ stage: Modified - name: Added3264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35433,7 +35433,7 @@ stage: Added - name: Added3265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35441,7 +35441,7 @@ stage: Added - name: Added3266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35449,7 +35449,7 @@ stage: Added - name: Added3267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35457,7 +35457,7 @@ stage: Added - name: Added3268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35465,7 +35465,7 @@ stage: Added - name: Added3269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35473,7 +35473,7 @@ stage: Added - name: Added3270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35481,7 +35481,7 @@ stage: Added - name: Added3271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35489,7 +35489,7 @@ stage: Added - name: Added3272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35497,7 +35497,7 @@ stage: Added - name: Added3273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35505,7 +35505,7 @@ stage: Added - name: Added3274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35513,7 +35513,7 @@ stage: Added - name: Added3275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35521,7 +35521,7 @@ stage: Added - name: Added3276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35529,7 +35529,7 @@ stage: Added - name: Added3277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35537,7 +35537,7 @@ stage: Added - name: Added3278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -35545,7 +35545,7 @@ stage: Added - name: Added3279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35553,7 +35553,7 @@ stage: Added - name: Added3280 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35569,7 +35569,7 @@ stage: Added - name: Added3281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35577,7 +35577,7 @@ stage: Added - name: Modified3282 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35597,7 +35597,7 @@ stage: Modified - name: Added3283 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35613,7 +35613,7 @@ stage: Added - name: Added3284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35621,7 +35621,7 @@ stage: Added - name: Modified3285 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35641,7 +35641,7 @@ stage: Modified - name: Added3286 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35657,7 +35657,7 @@ stage: Added - name: Added3287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35665,7 +35665,7 @@ stage: Added - name: Modified3288 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35685,7 +35685,7 @@ stage: Modified - name: Added3289 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35701,7 +35701,7 @@ stage: Added - name: Added3290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35709,7 +35709,7 @@ stage: Added - name: Modified3291 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35729,7 +35729,7 @@ stage: Modified - name: Added3292 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35745,7 +35745,7 @@ stage: Added - name: Added3293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35753,7 +35753,7 @@ stage: Added - name: Modified3294 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35773,7 +35773,7 @@ stage: Modified - name: Added3295 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35789,7 +35789,7 @@ stage: Added - name: Added3296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35797,7 +35797,7 @@ stage: Added - name: Modified3297 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35817,7 +35817,7 @@ stage: Modified - name: Added3298 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35833,7 +35833,7 @@ stage: Added - name: Added3299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35841,7 +35841,7 @@ stage: Added - name: Modified3300 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35861,7 +35861,7 @@ stage: Modified - name: Added3301 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35877,7 +35877,7 @@ stage: Added - name: Added3302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35885,7 +35885,7 @@ stage: Added - name: Modified3303 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35905,7 +35905,7 @@ stage: Modified - name: Added3304 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1320\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35920,7 +35920,7 @@ stage: Added - name: Added3305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1320\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1320\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35928,7 +35928,7 @@ stage: Added - name: Added3306 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1321\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35943,7 +35943,7 @@ stage: Added - name: Added3307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1321\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1321\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35951,7 +35951,7 @@ stage: Added - name: Added3308 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1322\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35966,7 +35966,7 @@ stage: Added - name: Added3309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1322\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1322\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35974,7 +35974,7 @@ stage: Added - name: Added3310 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1323\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -35989,7 +35989,7 @@ stage: Added - name: Added3311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1323\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1323\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -35997,7 +35997,7 @@ stage: Added - name: Added3312 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1324\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36012,7 +36012,7 @@ stage: Added - name: Added3313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1324\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1324\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36020,7 +36020,7 @@ stage: Added - name: Added3314 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1325\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36035,7 +36035,7 @@ stage: Added - name: Added3315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1325\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1325\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36043,7 +36043,7 @@ stage: Added - name: Added3316 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1326\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36058,7 +36058,7 @@ stage: Added - name: Added3317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1326\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1326\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36066,7 +36066,7 @@ stage: Added - name: Added3318 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1327\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36081,7 +36081,7 @@ stage: Added - name: Added3319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1327\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1327\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36089,7 +36089,7 @@ stage: Added - name: Added3320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36097,7 +36097,7 @@ stage: Added - name: Added3321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36105,7 +36105,7 @@ stage: Added - name: Modified3322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36113,7 +36113,7 @@ stage: Modified - name: Added3323 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36121,7 +36121,7 @@ stage: Added - name: Added3324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36129,7 +36129,7 @@ stage: Added - name: Modified3325 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36137,7 +36137,7 @@ stage: Modified - name: Added3326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36145,7 +36145,7 @@ stage: Added - name: Added3327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36153,7 +36153,7 @@ stage: Added - name: Modified3328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36161,7 +36161,7 @@ stage: Modified - name: Added3329 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36169,7 +36169,7 @@ stage: Added - name: Added3330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36177,7 +36177,7 @@ stage: Added - name: Modified3331 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36185,7 +36185,7 @@ stage: Modified - name: Added3332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36193,7 +36193,7 @@ stage: Added - name: Added3333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36201,7 +36201,7 @@ stage: Added - name: Modified3334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36209,7 +36209,7 @@ stage: Modified - name: Added3335 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36217,7 +36217,7 @@ stage: Added - name: Added3336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36225,7 +36225,7 @@ stage: Added - name: Modified3337 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36233,7 +36233,7 @@ stage: Modified - name: Added3338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36241,7 +36241,7 @@ stage: Added - name: Added3339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36249,7 +36249,7 @@ stage: Added - name: Modified3340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36257,7 +36257,7 @@ stage: Modified - name: Added3341 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36265,7 +36265,7 @@ stage: Added - name: Added3342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36273,7 +36273,7 @@ stage: Added - name: Modified3343 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -36281,14 +36281,14 @@ stage: Modified - name: Added3344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36296,14 +36296,14 @@ stage: Added - name: Added3346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36311,14 +36311,14 @@ stage: Added - name: Added3348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36326,14 +36326,14 @@ stage: Added - name: Added3350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36341,14 +36341,14 @@ stage: Added - name: Added3352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36356,14 +36356,14 @@ stage: Added - name: Added3354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36371,14 +36371,14 @@ stage: Added - name: Added3356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36386,14 +36386,14 @@ stage: Added - name: Added3358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36401,7 +36401,7 @@ stage: Added - name: Added3360 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36417,7 +36417,7 @@ stage: Added - name: Added3361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36425,7 +36425,7 @@ stage: Added - name: Modified3362 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36445,7 +36445,7 @@ stage: Modified - name: Added3363 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36461,7 +36461,7 @@ stage: Added - name: Added3364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36469,7 +36469,7 @@ stage: Added - name: Modified3365 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36489,7 +36489,7 @@ stage: Modified - name: Added3366 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36505,7 +36505,7 @@ stage: Added - name: Added3367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36513,7 +36513,7 @@ stage: Added - name: Modified3368 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36533,7 +36533,7 @@ stage: Modified - name: Added3369 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36549,7 +36549,7 @@ stage: Added - name: Added3370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36557,7 +36557,7 @@ stage: Added - name: Modified3371 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36577,7 +36577,7 @@ stage: Modified - name: Added3372 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36593,7 +36593,7 @@ stage: Added - name: Added3373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36601,7 +36601,7 @@ stage: Added - name: Modified3374 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36621,7 +36621,7 @@ stage: Modified - name: Added3375 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36637,7 +36637,7 @@ stage: Added - name: Added3376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36645,7 +36645,7 @@ stage: Added - name: Modified3377 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36665,7 +36665,7 @@ stage: Modified - name: Added3378 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36681,7 +36681,7 @@ stage: Added - name: Added3379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36689,7 +36689,7 @@ stage: Added - name: Modified3380 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36709,7 +36709,7 @@ stage: Modified - name: Added3381 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36725,7 +36725,7 @@ stage: Added - name: Added3382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36733,7 +36733,7 @@ stage: Added - name: Modified3383 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36753,7 +36753,7 @@ stage: Modified - name: Added3384 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1352\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36769,7 +36769,7 @@ stage: Added - name: Added3385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1352\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1352\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36777,7 +36777,7 @@ stage: Added - name: Added3386 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1353\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36793,7 +36793,7 @@ stage: Added - name: Added3387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1353\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1353\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36801,7 +36801,7 @@ stage: Added - name: Added3388 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1354\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36817,7 +36817,7 @@ stage: Added - name: Added3389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1354\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1354\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36825,7 +36825,7 @@ stage: Added - name: Added3390 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1355\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36841,7 +36841,7 @@ stage: Added - name: Added3391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1355\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1355\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36849,7 +36849,7 @@ stage: Added - name: Added3392 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1356\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36865,7 +36865,7 @@ stage: Added - name: Added3393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1356\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1356\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36873,7 +36873,7 @@ stage: Added - name: Added3394 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1357\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36889,7 +36889,7 @@ stage: Added - name: Added3395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1357\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1357\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36897,7 +36897,7 @@ stage: Added - name: Added3396 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1358\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36913,7 +36913,7 @@ stage: Added - name: Added3397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1358\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1358\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36921,7 +36921,7 @@ stage: Added - name: Added3398 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1359\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -36937,7 +36937,7 @@ stage: Added - name: Added3399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1359\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1359\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36945,7 +36945,7 @@ stage: Added - name: Added3400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -36953,7 +36953,7 @@ stage: Added - name: Added3401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36961,7 +36961,7 @@ stage: Added - name: Modified3402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -36969,7 +36969,7 @@ stage: Modified - name: Added3403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -36977,7 +36977,7 @@ stage: Added - name: Added3404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -36985,7 +36985,7 @@ stage: Added - name: Modified3405 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -36993,7 +36993,7 @@ stage: Modified - name: Added3406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37001,7 +37001,7 @@ stage: Added - name: Added3407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37009,7 +37009,7 @@ stage: Added - name: Modified3408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37017,7 +37017,7 @@ stage: Modified - name: Added3409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37025,7 +37025,7 @@ stage: Added - name: Added3410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37033,7 +37033,7 @@ stage: Added - name: Modified3411 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37041,7 +37041,7 @@ stage: Modified - name: Added3412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37049,7 +37049,7 @@ stage: Added - name: Added3413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37057,7 +37057,7 @@ stage: Added - name: Modified3414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37065,7 +37065,7 @@ stage: Modified - name: Added3415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37073,7 +37073,7 @@ stage: Added - name: Added3416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37081,7 +37081,7 @@ stage: Added - name: Modified3417 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37089,7 +37089,7 @@ stage: Modified - name: Added3418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37097,7 +37097,7 @@ stage: Added - name: Added3419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37105,7 +37105,7 @@ stage: Added - name: Modified3420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37113,7 +37113,7 @@ stage: Modified - name: Added3421 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37121,7 +37121,7 @@ stage: Added - name: Added3422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37129,7 +37129,7 @@ stage: Added - name: Modified3423 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -37137,7 +37137,7 @@ stage: Modified - name: Added3424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1368\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1368\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -37145,7 +37145,7 @@ stage: Added - name: Added3425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1368\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1368\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37153,7 +37153,7 @@ stage: Added - name: Added3426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1369\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1369\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -37161,7 +37161,7 @@ stage: Added - name: Added3427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1369\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1369\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37169,7 +37169,7 @@ stage: Added - name: Added3428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1370\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1370\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -37177,7 +37177,7 @@ stage: Added - name: Added3429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1370\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1370\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37185,7 +37185,7 @@ stage: Added - name: Added3430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1371\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1371\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -37193,7 +37193,7 @@ stage: Added - name: Added3431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1371\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1371\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37201,7 +37201,7 @@ stage: Added - name: Added3432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1372\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1372\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -37209,7 +37209,7 @@ stage: Added - name: Added3433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1372\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1372\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37217,7 +37217,7 @@ stage: Added - name: Added3434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1373\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1373\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -37225,7 +37225,7 @@ stage: Added - name: Added3435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1373\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1373\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37233,7 +37233,7 @@ stage: Added - name: Added3436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1374\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1374\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -37241,7 +37241,7 @@ stage: Added - name: Added3437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1374\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1374\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37249,7 +37249,7 @@ stage: Added - name: Added3438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1375\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1375\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -37257,7 +37257,7 @@ stage: Added - name: Added3439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1375\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1375\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37265,7 +37265,7 @@ stage: Added - name: Added3440 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37280,7 +37280,7 @@ stage: Added - name: Added3441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37288,7 +37288,7 @@ stage: Added - name: Modified3442 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37307,7 +37307,7 @@ stage: Modified - name: Added3443 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37322,7 +37322,7 @@ stage: Added - name: Added3444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37330,7 +37330,7 @@ stage: Added - name: Modified3445 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37349,7 +37349,7 @@ stage: Modified - name: Added3446 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37364,7 +37364,7 @@ stage: Added - name: Added3447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37372,7 +37372,7 @@ stage: Added - name: Modified3448 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37391,7 +37391,7 @@ stage: Modified - name: Added3449 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37406,7 +37406,7 @@ stage: Added - name: Added3450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37414,7 +37414,7 @@ stage: Added - name: Modified3451 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37433,7 +37433,7 @@ stage: Modified - name: Added3452 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37448,7 +37448,7 @@ stage: Added - name: Added3453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37456,7 +37456,7 @@ stage: Added - name: Modified3454 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37475,7 +37475,7 @@ stage: Modified - name: Added3455 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37490,7 +37490,7 @@ stage: Added - name: Added3456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37498,7 +37498,7 @@ stage: Added - name: Modified3457 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37517,7 +37517,7 @@ stage: Modified - name: Added3458 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37532,7 +37532,7 @@ stage: Added - name: Added3459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37540,7 +37540,7 @@ stage: Added - name: Modified3460 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37559,7 +37559,7 @@ stage: Modified - name: Added3461 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37574,7 +37574,7 @@ stage: Added - name: Added3462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37582,7 +37582,7 @@ stage: Added - name: Modified3463 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37601,7 +37601,7 @@ stage: Modified - name: Added3464 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1384\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37616,7 +37616,7 @@ stage: Added - name: Added3465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1384\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1384\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37624,7 +37624,7 @@ stage: Added - name: Added3466 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1385\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37639,7 +37639,7 @@ stage: Added - name: Added3467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1385\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1385\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37647,7 +37647,7 @@ stage: Added - name: Added3468 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1386\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37662,7 +37662,7 @@ stage: Added - name: Added3469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1386\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1386\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37670,7 +37670,7 @@ stage: Added - name: Added3470 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1387\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37685,7 +37685,7 @@ stage: Added - name: Added3471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1387\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1387\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37693,7 +37693,7 @@ stage: Added - name: Added3472 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1388\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37708,7 +37708,7 @@ stage: Added - name: Added3473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1388\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1388\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37716,7 +37716,7 @@ stage: Added - name: Added3474 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1389\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37731,7 +37731,7 @@ stage: Added - name: Added3475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1389\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1389\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37739,7 +37739,7 @@ stage: Added - name: Added3476 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1390\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37754,7 +37754,7 @@ stage: Added - name: Added3477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1390\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1390\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37762,7 +37762,7 @@ stage: Added - name: Added3478 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1391\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -37777,7 +37777,7 @@ stage: Added - name: Added3479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1391\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1391\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37785,14 +37785,14 @@ stage: Added - name: Added3480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Added - name: Added3481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37800,21 +37800,21 @@ stage: Added - name: Modified3482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Modified - name: Added3483 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Added - name: Added3484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37822,21 +37822,21 @@ stage: Added - name: Modified3485 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Modified - name: Added3486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Added - name: Added3487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37844,21 +37844,21 @@ stage: Added - name: Modified3488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Modified - name: Added3489 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Added - name: Added3490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37866,21 +37866,21 @@ stage: Added - name: Modified3491 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Modified - name: Added3492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Added - name: Added3493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37888,21 +37888,21 @@ stage: Added - name: Modified3494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Modified - name: Added3495 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Added - name: Added3496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37910,21 +37910,21 @@ stage: Added - name: Modified3497 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Modified - name: Added3498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Added - name: Added3499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37932,21 +37932,21 @@ stage: Added - name: Modified3500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Modified - name: Added3501 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Added - name: Added3502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37954,21 +37954,21 @@ stage: Added - name: Modified3503 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "mtime": 1606723051, "checksum": "6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}' stage: Modified - name: Added3504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1400\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1400\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1400\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1400\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37976,14 +37976,14 @@ stage: Added - name: Added3506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1401\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1401\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1401\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1401\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -37991,14 +37991,14 @@ stage: Added - name: Added3508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1402\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1402\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1402\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1402\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38006,14 +38006,14 @@ stage: Added - name: Added3510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1403\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1403\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1403\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1403\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38021,14 +38021,14 @@ stage: Added - name: Added3512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1404\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1404\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1404\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1404\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38036,14 +38036,14 @@ stage: Added - name: Added3514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1405\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1405\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1405\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1405\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38051,14 +38051,14 @@ stage: Added - name: Added3516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1406\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1406\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1406\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1406\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38066,14 +38066,14 @@ stage: Added - name: Added3518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1407\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1407\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1407\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1407\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38081,7 +38081,7 @@ stage: Added - name: Added3520 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38097,7 +38097,7 @@ stage: Added - name: Added3521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38105,7 +38105,7 @@ stage: Added - name: Modified3522 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38125,7 +38125,7 @@ stage: Modified - name: Added3523 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38141,7 +38141,7 @@ stage: Added - name: Added3524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38149,7 +38149,7 @@ stage: Added - name: Modified3525 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38169,7 +38169,7 @@ stage: Modified - name: Added3526 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38185,7 +38185,7 @@ stage: Added - name: Added3527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38193,7 +38193,7 @@ stage: Added - name: Modified3528 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38213,7 +38213,7 @@ stage: Modified - name: Added3529 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38229,7 +38229,7 @@ stage: Added - name: Added3530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38237,7 +38237,7 @@ stage: Added - name: Modified3531 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38257,7 +38257,7 @@ stage: Modified - name: Added3532 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38273,7 +38273,7 @@ stage: Added - name: Added3533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38281,7 +38281,7 @@ stage: Added - name: Modified3534 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38301,7 +38301,7 @@ stage: Modified - name: Added3535 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38317,7 +38317,7 @@ stage: Added - name: Added3536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38325,7 +38325,7 @@ stage: Added - name: Modified3537 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38345,7 +38345,7 @@ stage: Modified - name: Added3538 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38361,7 +38361,7 @@ stage: Added - name: Added3539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38369,7 +38369,7 @@ stage: Added - name: Modified3540 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38389,7 +38389,7 @@ stage: Modified - name: Added3541 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38405,7 +38405,7 @@ stage: Added - name: Added3542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38413,7 +38413,7 @@ stage: Added - name: Modified3543 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38433,7 +38433,7 @@ stage: Modified - name: Added3544 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1416\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38449,7 +38449,7 @@ stage: Added - name: Added3545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1416\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1416\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38457,7 +38457,7 @@ stage: Added - name: Added3546 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1417\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38473,7 +38473,7 @@ stage: Added - name: Added3547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1417\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1417\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38481,7 +38481,7 @@ stage: Added - name: Added3548 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1418\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38497,7 +38497,7 @@ stage: Added - name: Added3549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1418\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1418\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38505,7 +38505,7 @@ stage: Added - name: Added3550 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1419\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38521,7 +38521,7 @@ stage: Added - name: Added3551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1419\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1419\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38529,7 +38529,7 @@ stage: Added - name: Added3552 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1420\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38545,7 +38545,7 @@ stage: Added - name: Added3553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1420\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1420\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38553,7 +38553,7 @@ stage: Added - name: Added3554 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1421\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38569,7 +38569,7 @@ stage: Added - name: Added3555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1421\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1421\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38577,7 +38577,7 @@ stage: Added - name: Added3556 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1422\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38593,7 +38593,7 @@ stage: Added - name: Added3557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1422\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1422\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38601,7 +38601,7 @@ stage: Added - name: Added3558 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1423\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38617,7 +38617,7 @@ stage: Added - name: Added3559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1423\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1423\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38625,7 +38625,7 @@ stage: Added - name: Added3560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769876,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key", "arch": "[x64]", "timestamp": 1606769876, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38633,7 +38633,7 @@ stage: Added - name: Added3561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769876,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38641,7 +38641,7 @@ stage: Added - name: Modified3562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38649,7 +38649,7 @@ stage: Modified - name: Added3563 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38657,7 +38657,7 @@ stage: Added - name: Added3564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38665,7 +38665,7 @@ stage: Added - name: Modified3565 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38673,7 +38673,7 @@ stage: Modified - name: Added3566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38681,7 +38681,7 @@ stage: Added - name: Added3567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38689,7 +38689,7 @@ stage: Added - name: Modified3568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38697,7 +38697,7 @@ stage: Modified - name: Added3569 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38705,7 +38705,7 @@ stage: Added - name: Added3570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38713,7 +38713,7 @@ stage: Added - name: Modified3571 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38721,7 +38721,7 @@ stage: Modified - name: Added3572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38729,7 +38729,7 @@ stage: Added - name: Added3573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38737,7 +38737,7 @@ stage: Added - name: Modified3574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38745,7 +38745,7 @@ stage: Modified - name: Added3575 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38753,7 +38753,7 @@ stage: Added - name: Added3576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38761,7 +38761,7 @@ stage: Added - name: Modified3577 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38769,7 +38769,7 @@ stage: Modified - name: Added3578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38777,7 +38777,7 @@ stage: Added - name: Added3579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38785,7 +38785,7 @@ stage: Added - name: Modified3580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38793,7 +38793,7 @@ stage: Modified - name: Added3581 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38801,7 +38801,7 @@ stage: Added - name: Added3582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38809,7 +38809,7 @@ stage: Added - name: Modified3583 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38817,7 +38817,7 @@ stage: Modified - name: Added3584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38825,7 +38825,7 @@ stage: Added - name: Added3585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38833,7 +38833,7 @@ stage: Added - name: Added3586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38841,7 +38841,7 @@ stage: Added - name: Added3587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38849,7 +38849,7 @@ stage: Added - name: Added3588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38857,7 +38857,7 @@ stage: Added - name: Added3589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38865,7 +38865,7 @@ stage: Added - name: Added3590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38873,7 +38873,7 @@ stage: Added - name: Added3591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38881,7 +38881,7 @@ stage: Added - name: Added3592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38889,7 +38889,7 @@ stage: Added - name: Added3593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38897,7 +38897,7 @@ stage: Added - name: Added3594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38905,7 +38905,7 @@ stage: Added - name: Added3595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38913,7 +38913,7 @@ stage: Added - name: Added3596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38921,7 +38921,7 @@ stage: Added - name: Added3597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38929,7 +38929,7 @@ stage: Added - name: Added3598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -38937,7 +38937,7 @@ stage: Added - name: Added3599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -38945,7 +38945,7 @@ stage: Added - name: Added3600 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38961,7 +38961,7 @@ stage: Added - name: Added3601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -38969,7 +38969,7 @@ stage: Added - name: Modified3602 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -38989,7 +38989,7 @@ stage: Modified - name: Added3603 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39005,7 +39005,7 @@ stage: Added - name: Added3604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39013,7 +39013,7 @@ stage: Added - name: Modified3605 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39033,7 +39033,7 @@ stage: Modified - name: Added3606 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39049,7 +39049,7 @@ stage: Added - name: Added3607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39057,7 +39057,7 @@ stage: Added - name: Modified3608 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39077,7 +39077,7 @@ stage: Modified - name: Added3609 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39093,7 +39093,7 @@ stage: Added - name: Added3610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39101,7 +39101,7 @@ stage: Added - name: Modified3611 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39121,7 +39121,7 @@ stage: Modified - name: Added3612 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39137,7 +39137,7 @@ stage: Added - name: Added3613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39145,7 +39145,7 @@ stage: Added - name: Modified3614 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39165,7 +39165,7 @@ stage: Modified - name: Added3615 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39181,7 +39181,7 @@ stage: Added - name: Added3616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39189,7 +39189,7 @@ stage: Added - name: Modified3617 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39209,7 +39209,7 @@ stage: Modified - name: Added3618 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39225,7 +39225,7 @@ stage: Added - name: Added3619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39233,7 +39233,7 @@ stage: Added - name: Modified3620 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39253,7 +39253,7 @@ stage: Modified - name: Added3621 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39269,7 +39269,7 @@ stage: Added - name: Added3622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39277,7 +39277,7 @@ stage: Added - name: Modified3623 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39297,7 +39297,7 @@ stage: Modified - name: Added3624 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1448\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39312,7 +39312,7 @@ stage: Added - name: Added3625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1448\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1448\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39320,7 +39320,7 @@ stage: Added - name: Added3626 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1449\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39335,7 +39335,7 @@ stage: Added - name: Added3627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1449\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1449\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39343,7 +39343,7 @@ stage: Added - name: Added3628 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1450\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39358,7 +39358,7 @@ stage: Added - name: Added3629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1450\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1450\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39366,7 +39366,7 @@ stage: Added - name: Added3630 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1451\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39381,7 +39381,7 @@ stage: Added - name: Added3631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1451\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1451\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39389,7 +39389,7 @@ stage: Added - name: Added3632 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1452\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39404,7 +39404,7 @@ stage: Added - name: Added3633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1452\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1452\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39412,7 +39412,7 @@ stage: Added - name: Added3634 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1453\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39427,7 +39427,7 @@ stage: Added - name: Added3635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1453\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1453\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39435,7 +39435,7 @@ stage: Added - name: Added3636 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1454\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39450,7 +39450,7 @@ stage: Added - name: Added3637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1454\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1454\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39458,7 +39458,7 @@ stage: Added - name: Added3638 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1455\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39473,7 +39473,7 @@ stage: Added - name: Added3639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1455\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1455\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39481,7 +39481,7 @@ stage: Added - name: Added3640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39489,7 +39489,7 @@ stage: Added - name: Added3641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39497,7 +39497,7 @@ stage: Added - name: Modified3642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39505,7 +39505,7 @@ stage: Modified - name: Added3643 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39513,7 +39513,7 @@ stage: Added - name: Added3644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39521,7 +39521,7 @@ stage: Added - name: Modified3645 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39529,7 +39529,7 @@ stage: Modified - name: Added3646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39537,7 +39537,7 @@ stage: Added - name: Added3647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39545,7 +39545,7 @@ stage: Added - name: Modified3648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39553,7 +39553,7 @@ stage: Modified - name: Added3649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39561,7 +39561,7 @@ stage: Added - name: Added3650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39569,7 +39569,7 @@ stage: Added - name: Modified3651 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39577,7 +39577,7 @@ stage: Modified - name: Added3652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39585,7 +39585,7 @@ stage: Added - name: Added3653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39593,7 +39593,7 @@ stage: Added - name: Modified3654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39601,7 +39601,7 @@ stage: Modified - name: Added3655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39609,7 +39609,7 @@ stage: Added - name: Added3656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39617,7 +39617,7 @@ stage: Added - name: Modified3657 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39625,7 +39625,7 @@ stage: Modified - name: Added3658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39633,7 +39633,7 @@ stage: Added - name: Added3659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39641,7 +39641,7 @@ stage: Added - name: Modified3660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39649,7 +39649,7 @@ stage: Modified - name: Added3661 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39657,7 +39657,7 @@ stage: Added - name: Added3662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39665,7 +39665,7 @@ stage: Added - name: Modified3663 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723051, @@ -39673,14 +39673,14 @@ stage: Modified - name: Added3664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39688,14 +39688,14 @@ stage: Added - name: Added3666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39703,14 +39703,14 @@ stage: Added - name: Added3668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39718,14 +39718,14 @@ stage: Added - name: Added3670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39733,14 +39733,14 @@ stage: Added - name: Added3672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39748,14 +39748,14 @@ stage: Added - name: Added3674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39763,14 +39763,14 @@ stage: Added - name: Added3676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39778,14 +39778,14 @@ stage: Added - name: Added3678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39793,7 +39793,7 @@ stage: Added - name: Added3680 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39809,7 +39809,7 @@ stage: Added - name: Added3681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39817,7 +39817,7 @@ stage: Added - name: Modified3682 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39837,7 +39837,7 @@ stage: Modified - name: Added3683 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39853,7 +39853,7 @@ stage: Added - name: Added3684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39861,7 +39861,7 @@ stage: Added - name: Modified3685 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39881,7 +39881,7 @@ stage: Modified - name: Added3686 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39897,7 +39897,7 @@ stage: Added - name: Added3687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39905,7 +39905,7 @@ stage: Added - name: Modified3688 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39925,7 +39925,7 @@ stage: Modified - name: Added3689 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39941,7 +39941,7 @@ stage: Added - name: Added3690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -39949,7 +39949,7 @@ stage: Added - name: Modified3691 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39969,7 +39969,7 @@ stage: Modified - name: Added3692 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -39985,7 +39985,7 @@ stage: Added - name: Added3693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -39993,7 +39993,7 @@ stage: Added - name: Modified3694 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40013,7 +40013,7 @@ stage: Modified - name: Added3695 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40029,7 +40029,7 @@ stage: Added - name: Added3696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40037,7 +40037,7 @@ stage: Added - name: Modified3697 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40057,7 +40057,7 @@ stage: Modified - name: Added3698 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40073,7 +40073,7 @@ stage: Added - name: Added3699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40081,7 +40081,7 @@ stage: Added - name: Modified3700 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40101,7 +40101,7 @@ stage: Modified - name: Added3701 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40117,7 +40117,7 @@ stage: Added - name: Added3702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40125,7 +40125,7 @@ stage: Added - name: Modified3703 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40145,7 +40145,7 @@ stage: Modified - name: Added3704 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1480\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40161,7 +40161,7 @@ stage: Added - name: Added3705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1480\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1480\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40169,7 +40169,7 @@ stage: Added - name: Added3706 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1481\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40185,7 +40185,7 @@ stage: Added - name: Added3707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1481\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1481\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40193,7 +40193,7 @@ stage: Added - name: Added3708 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1482\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40209,7 +40209,7 @@ stage: Added - name: Added3709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1482\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1482\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40217,7 +40217,7 @@ stage: Added - name: Added3710 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1483\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40233,7 +40233,7 @@ stage: Added - name: Added3711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1483\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1483\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40241,7 +40241,7 @@ stage: Added - name: Added3712 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1484\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40257,7 +40257,7 @@ stage: Added - name: Added3713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1484\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1484\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40265,7 +40265,7 @@ stage: Added - name: Added3714 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1485\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40281,7 +40281,7 @@ stage: Added - name: Added3715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1485\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1485\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40289,7 +40289,7 @@ stage: Added - name: Added3716 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1486\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40305,7 +40305,7 @@ stage: Added - name: Added3717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1486\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1486\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40313,7 +40313,7 @@ stage: Added - name: Added3718 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1487\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40329,7 +40329,7 @@ stage: Added - name: Added3719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1487\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1487\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40337,7 +40337,7 @@ stage: Added - name: Added3720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40345,7 +40345,7 @@ stage: Added - name: Added3721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40353,7 +40353,7 @@ stage: Added - name: Modified3722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40361,7 +40361,7 @@ stage: Modified - name: Added3723 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40369,7 +40369,7 @@ stage: Added - name: Added3724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40377,7 +40377,7 @@ stage: Added - name: Modified3725 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40385,7 +40385,7 @@ stage: Modified - name: Added3726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40393,7 +40393,7 @@ stage: Added - name: Added3727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40401,7 +40401,7 @@ stage: Added - name: Modified3728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40409,7 +40409,7 @@ stage: Modified - name: Added3729 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40417,7 +40417,7 @@ stage: Added - name: Added3730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40425,7 +40425,7 @@ stage: Added - name: Modified3731 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40433,7 +40433,7 @@ stage: Modified - name: Added3732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40441,7 +40441,7 @@ stage: Added - name: Added3733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40449,7 +40449,7 @@ stage: Added - name: Modified3734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40457,7 +40457,7 @@ stage: Modified - name: Added3735 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40465,7 +40465,7 @@ stage: Added - name: Added3736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40473,7 +40473,7 @@ stage: Added - name: Modified3737 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40481,7 +40481,7 @@ stage: Modified - name: Added3738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40489,7 +40489,7 @@ stage: Added - name: Added3739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40497,7 +40497,7 @@ stage: Added - name: Modified3740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40505,7 +40505,7 @@ stage: Modified - name: Added3741 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40513,7 +40513,7 @@ stage: Added - name: Added3742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40521,7 +40521,7 @@ stage: Added - name: Modified3743 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -40529,7 +40529,7 @@ stage: Modified - name: Added3744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1496\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1496\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -40537,7 +40537,7 @@ stage: Added - name: Added3745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1496\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1496\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40545,7 +40545,7 @@ stage: Added - name: Added3746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1497\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1497\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -40553,7 +40553,7 @@ stage: Added - name: Added3747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1497\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1497\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40561,7 +40561,7 @@ stage: Added - name: Added3748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1498\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1498\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -40569,7 +40569,7 @@ stage: Added - name: Added3749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1498\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1498\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40577,7 +40577,7 @@ stage: Added - name: Added3750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1499\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1499\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -40585,7 +40585,7 @@ stage: Added - name: Added3751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1499\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1499\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40593,7 +40593,7 @@ stage: Added - name: Added3752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1500\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1500\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -40601,7 +40601,7 @@ stage: Added - name: Added3753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1500\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1500\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40609,7 +40609,7 @@ stage: Added - name: Added3754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1501\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1501\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -40617,7 +40617,7 @@ stage: Added - name: Added3755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1501\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1501\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40625,7 +40625,7 @@ stage: Added - name: Added3756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1502\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1502\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -40633,7 +40633,7 @@ stage: Added - name: Added3757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1502\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1502\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40641,7 +40641,7 @@ stage: Added - name: Added3758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1503\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1503\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -40649,7 +40649,7 @@ stage: Added - name: Added3759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1503\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1503\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40657,7 +40657,7 @@ stage: Added - name: Added3760 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40672,7 +40672,7 @@ stage: Added - name: Added3761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40680,7 +40680,7 @@ stage: Added - name: Modified3762 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40699,7 +40699,7 @@ stage: Modified - name: Added3763 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40714,7 +40714,7 @@ stage: Added - name: Added3764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40722,7 +40722,7 @@ stage: Added - name: Modified3765 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40741,7 +40741,7 @@ stage: Modified - name: Added3766 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40756,7 +40756,7 @@ stage: Added - name: Added3767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40764,7 +40764,7 @@ stage: Added - name: Modified3768 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40783,7 +40783,7 @@ stage: Modified - name: Added3769 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40798,7 +40798,7 @@ stage: Added - name: Added3770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -40806,7 +40806,7 @@ stage: Added - name: Modified3771 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40825,7 +40825,7 @@ stage: Modified - name: Added3772 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40840,7 +40840,7 @@ stage: Added - name: Added3773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40848,7 +40848,7 @@ stage: Added - name: Modified3774 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40867,7 +40867,7 @@ stage: Modified - name: Added3775 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40882,7 +40882,7 @@ stage: Added - name: Added3776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40890,7 +40890,7 @@ stage: Added - name: Modified3777 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40909,7 +40909,7 @@ stage: Modified - name: Added3778 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40924,7 +40924,7 @@ stage: Added - name: Added3779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40932,7 +40932,7 @@ stage: Added - name: Modified3780 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40951,7 +40951,7 @@ stage: Modified - name: Added3781 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40966,7 +40966,7 @@ stage: Added - name: Added3782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -40974,7 +40974,7 @@ stage: Added - name: Modified3783 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -40993,7 +40993,7 @@ stage: Modified - name: Added3784 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1512\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41008,7 +41008,7 @@ stage: Added - name: Added3785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1512\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1512\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41016,7 +41016,7 @@ stage: Added - name: Added3786 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1513\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41031,7 +41031,7 @@ stage: Added - name: Added3787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1513\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1513\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41039,7 +41039,7 @@ stage: Added - name: Added3788 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1514\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41054,7 +41054,7 @@ stage: Added - name: Added3789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1514\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1514\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41062,7 +41062,7 @@ stage: Added - name: Added3790 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1515\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41077,7 +41077,7 @@ stage: Added - name: Added3791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1515\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1515\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41085,7 +41085,7 @@ stage: Added - name: Added3792 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1516\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41100,7 +41100,7 @@ stage: Added - name: Added3793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1516\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1516\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41108,7 +41108,7 @@ stage: Added - name: Added3794 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1517\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41123,7 +41123,7 @@ stage: Added - name: Added3795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1517\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1517\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41131,7 +41131,7 @@ stage: Added - name: Added3796 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1518\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41146,7 +41146,7 @@ stage: Added - name: Added3797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1518\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1518\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41154,7 +41154,7 @@ stage: Added - name: Added3798 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1519\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41169,7 +41169,7 @@ stage: Added - name: Added3799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1519\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1519\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41177,14 +41177,14 @@ stage: Added - name: Added3800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Added - name: Added3801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41192,21 +41192,21 @@ stage: Added - name: Modified3802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Modified - name: Added3803 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Added - name: Added3804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41214,21 +41214,21 @@ stage: Added - name: Modified3805 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Modified - name: Added3806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Added - name: Added3807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41236,21 +41236,21 @@ stage: Added - name: Modified3808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Modified - name: Added3809 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Added - name: Added3810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41258,21 +41258,21 @@ stage: Added - name: Modified3811 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Modified - name: Added3812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Added - name: Added3813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41280,21 +41280,21 @@ stage: Added - name: Modified3814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Modified - name: Added3815 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Added - name: Added3816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41302,21 +41302,21 @@ stage: Added - name: Modified3817 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Modified - name: Added3818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Added - name: Added3819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41324,21 +41324,21 @@ stage: Added - name: Modified3820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Modified - name: Added3821 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Added - name: Added3822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41346,21 +41346,21 @@ stage: Added - name: Modified3823 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723052, "checksum": "61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}' stage: Modified - name: Added3824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1528\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1528\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1528\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1528\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41368,14 +41368,14 @@ stage: Added - name: Added3826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1529\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1529\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1529\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1529\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41383,14 +41383,14 @@ stage: Added - name: Added3828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1530\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1530\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1530\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1530\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41398,14 +41398,14 @@ stage: Added - name: Added3830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1531\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1531\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1531\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1531\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -41413,14 +41413,14 @@ stage: Added - name: Added3832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1532\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1532\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1532\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1532\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41428,14 +41428,14 @@ stage: Added - name: Added3834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1533\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1533\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1533\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1533\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41443,14 +41443,14 @@ stage: Added - name: Added3836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1534\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1534\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1534\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1534\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41458,14 +41458,14 @@ stage: Added - name: Added3838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1535\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1535\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added3839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1535\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1535\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -41473,7 +41473,7 @@ stage: Added - name: Added3840 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41489,7 +41489,7 @@ stage: Added - name: Added3841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -41498,7 +41498,7 @@ stage: Added - name: Modified3842 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41518,7 +41518,7 @@ stage: Modified - name: Added3843 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41534,7 +41534,7 @@ stage: Added - name: Added3844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -41543,7 +41543,7 @@ stage: Added - name: Modified3845 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41563,7 +41563,7 @@ stage: Modified - name: Added3846 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41579,7 +41579,7 @@ stage: Added - name: Added3847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -41588,7 +41588,7 @@ stage: Added - name: Modified3848 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41608,7 +41608,7 @@ stage: Modified - name: Added3849 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41624,7 +41624,7 @@ stage: Added - name: Added3850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -41633,7 +41633,7 @@ stage: Added - name: Modified3851 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41653,7 +41653,7 @@ stage: Modified - name: Added3852 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41669,7 +41669,7 @@ stage: Added - name: Added3853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -41677,7 +41677,7 @@ stage: Added - name: Modified3854 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41697,7 +41697,7 @@ stage: Modified - name: Added3855 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41713,7 +41713,7 @@ stage: Added - name: Added3856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -41721,7 +41721,7 @@ stage: Added - name: Modified3857 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41741,7 +41741,7 @@ stage: Modified - name: Added3858 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41757,7 +41757,7 @@ stage: Added - name: Added3859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -41765,7 +41765,7 @@ stage: Added - name: Modified3860 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41785,7 +41785,7 @@ stage: Modified - name: Added3861 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41801,7 +41801,7 @@ stage: Added - name: Added3862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -41809,7 +41809,7 @@ stage: Added - name: Modified3863 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41829,7 +41829,7 @@ stage: Modified - name: Added3864 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1544\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41845,7 +41845,7 @@ stage: Added - name: Added3865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1544\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1544\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -41854,7 +41854,7 @@ stage: Added - name: Added3866 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1545\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41870,7 +41870,7 @@ stage: Added - name: Added3867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1545\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1545\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -41879,7 +41879,7 @@ stage: Added - name: Added3868 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1546\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41895,7 +41895,7 @@ stage: Added - name: Added3869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1546\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1546\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -41904,7 +41904,7 @@ stage: Added - name: Added3870 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1547\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41920,7 +41920,7 @@ stage: Added - name: Added3871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1547\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1547\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -41929,7 +41929,7 @@ stage: Added - name: Added3872 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1548\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41945,7 +41945,7 @@ stage: Added - name: Added3873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1548\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1548\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -41953,7 +41953,7 @@ stage: Added - name: Added3874 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1549\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41969,7 +41969,7 @@ stage: Added - name: Added3875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1549\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1549\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -41977,7 +41977,7 @@ stage: Added - name: Added3876 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1550\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -41993,7 +41993,7 @@ stage: Added - name: Added3877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1550\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1550\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42001,7 +42001,7 @@ stage: Added - name: Added3878 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1551\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42017,7 +42017,7 @@ stage: Added - name: Added3879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1551\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1551\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42025,7 +42025,7 @@ stage: Added - name: Added3880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42033,7 +42033,7 @@ stage: Added - name: Added3881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42042,7 +42042,7 @@ stage: Added - name: Modified3882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42050,7 +42050,7 @@ stage: Modified - name: Added3883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42058,7 +42058,7 @@ stage: Added - name: Added3884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42067,7 +42067,7 @@ stage: Added - name: Modified3885 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42075,7 +42075,7 @@ stage: Modified - name: Added3886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42083,7 +42083,7 @@ stage: Added - name: Added3887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42092,7 +42092,7 @@ stage: Added - name: Modified3888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42100,7 +42100,7 @@ stage: Modified - name: Added3889 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42108,7 +42108,7 @@ stage: Added - name: Added3890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42117,7 +42117,7 @@ stage: Added - name: Modified3891 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42125,7 +42125,7 @@ stage: Modified - name: Added3892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42133,7 +42133,7 @@ stage: Added - name: Added3893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42141,7 +42141,7 @@ stage: Added - name: Modified3894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42149,7 +42149,7 @@ stage: Modified - name: Added3895 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42157,7 +42157,7 @@ stage: Added - name: Added3896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42165,7 +42165,7 @@ stage: Added - name: Modified3897 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42173,7 +42173,7 @@ stage: Modified - name: Added3898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42181,7 +42181,7 @@ stage: Added - name: Added3899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42189,7 +42189,7 @@ stage: Added - name: Modified3900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42197,7 +42197,7 @@ stage: Modified - name: Added3901 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42205,7 +42205,7 @@ stage: Added - name: Added3902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42213,7 +42213,7 @@ stage: Added - name: Modified3903 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42221,7 +42221,7 @@ stage: Modified - name: Added3904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42229,7 +42229,7 @@ stage: Added - name: Added3905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42238,7 +42238,7 @@ stage: Added - name: Added3906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42246,7 +42246,7 @@ stage: Added - name: Added3907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42255,7 +42255,7 @@ stage: Added - name: Added3908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42263,7 +42263,7 @@ stage: Added - name: Added3909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42272,7 +42272,7 @@ stage: Added - name: Added3910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42280,7 +42280,7 @@ stage: Added - name: Added3911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42289,7 +42289,7 @@ stage: Added - name: Added3912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42297,7 +42297,7 @@ stage: Added - name: Added3913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42305,7 +42305,7 @@ stage: Added - name: Added3914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42313,7 +42313,7 @@ stage: Added - name: Added3915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42321,7 +42321,7 @@ stage: Added - name: Added3916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42329,7 +42329,7 @@ stage: Added - name: Added3917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42337,7 +42337,7 @@ stage: Added - name: Added3918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -42345,7 +42345,7 @@ stage: Added - name: Added3919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42353,7 +42353,7 @@ stage: Added - name: Added3920 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42369,7 +42369,7 @@ stage: Added - name: Added3921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42378,7 +42378,7 @@ stage: Added - name: Modified3922 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42398,7 +42398,7 @@ stage: Modified - name: Added3923 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42414,7 +42414,7 @@ stage: Added - name: Added3924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42423,7 +42423,7 @@ stage: Added - name: Modified3925 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42443,7 +42443,7 @@ stage: Modified - name: Added3926 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42459,7 +42459,7 @@ stage: Added - name: Added3927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42468,7 +42468,7 @@ stage: Added - name: Modified3928 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42488,7 +42488,7 @@ stage: Modified - name: Added3929 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42504,7 +42504,7 @@ stage: Added - name: Added3930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42513,7 +42513,7 @@ stage: Added - name: Modified3931 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42533,7 +42533,7 @@ stage: Modified - name: Added3932 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42549,7 +42549,7 @@ stage: Added - name: Added3933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42557,7 +42557,7 @@ stage: Added - name: Modified3934 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42577,7 +42577,7 @@ stage: Modified - name: Added3935 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42593,7 +42593,7 @@ stage: Added - name: Added3936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42601,7 +42601,7 @@ stage: Added - name: Modified3937 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42621,7 +42621,7 @@ stage: Modified - name: Added3938 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42637,7 +42637,7 @@ stage: Added - name: Added3939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42645,7 +42645,7 @@ stage: Added - name: Modified3940 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42665,7 +42665,7 @@ stage: Modified - name: Added3941 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42681,7 +42681,7 @@ stage: Added - name: Added3942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42689,7 +42689,7 @@ stage: Added - name: Modified3943 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42709,7 +42709,7 @@ stage: Modified - name: Added3944 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1576\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42724,7 +42724,7 @@ stage: Added - name: Added3945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1576\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1576\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42733,7 +42733,7 @@ stage: Added - name: Added3946 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1577\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42748,7 +42748,7 @@ stage: Added - name: Added3947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1577\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1577\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42757,7 +42757,7 @@ stage: Added - name: Added3948 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1578\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42772,7 +42772,7 @@ stage: Added - name: Added3949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1578\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1578\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42781,7 +42781,7 @@ stage: Added - name: Added3950 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1579\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42796,7 +42796,7 @@ stage: Added - name: Added3951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1579\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1579\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42805,7 +42805,7 @@ stage: Added - name: Added3952 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1580\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42820,7 +42820,7 @@ stage: Added - name: Added3953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1580\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1580\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42828,7 +42828,7 @@ stage: Added - name: Added3954 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1581\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42843,7 +42843,7 @@ stage: Added - name: Added3955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1581\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1581\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42851,7 +42851,7 @@ stage: Added - name: Added3956 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1582\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42866,7 +42866,7 @@ stage: Added - name: Added3957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1582\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1582\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42874,7 +42874,7 @@ stage: Added - name: Added3958 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1583\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -42889,7 +42889,7 @@ stage: Added - name: Added3959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1583\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1583\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -42897,7 +42897,7 @@ stage: Added - name: Added3960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -42905,7 +42905,7 @@ stage: Added - name: Added3961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42914,7 +42914,7 @@ stage: Added - name: Modified3962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -42922,7 +42922,7 @@ stage: Modified - name: Added3963 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -42930,7 +42930,7 @@ stage: Added - name: Added3964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42939,7 +42939,7 @@ stage: Added - name: Modified3965 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -42947,7 +42947,7 @@ stage: Modified - name: Added3966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -42955,7 +42955,7 @@ stage: Added - name: Added3967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42964,7 +42964,7 @@ stage: Added - name: Modified3968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -42972,7 +42972,7 @@ stage: Modified - name: Added3969 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -42980,7 +42980,7 @@ stage: Added - name: Added3970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -42989,7 +42989,7 @@ stage: Added - name: Modified3971 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -42997,7 +42997,7 @@ stage: Modified - name: Added3972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -43005,7 +43005,7 @@ stage: Added - name: Added3973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43013,7 +43013,7 @@ stage: Added - name: Modified3974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -43021,7 +43021,7 @@ stage: Modified - name: Added3975 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -43029,7 +43029,7 @@ stage: Added - name: Added3976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43037,7 +43037,7 @@ stage: Added - name: Modified3977 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -43045,7 +43045,7 @@ stage: Modified - name: Added3978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -43053,7 +43053,7 @@ stage: Added - name: Added3979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43061,7 +43061,7 @@ stage: Added - name: Modified3980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -43069,7 +43069,7 @@ stage: Modified - name: Added3981 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -43077,7 +43077,7 @@ stage: Added - name: Added3982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43085,7 +43085,7 @@ stage: Added - name: Modified3983 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722882,"checksum":"fc4ea5e608c162bc2a3557106411462448995a46"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723052, @@ -43093,14 +43093,14 @@ stage: Modified - name: Added3984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43109,14 +43109,14 @@ stage: Added - name: Added3986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43125,14 +43125,14 @@ stage: Added - name: Added3988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43141,14 +43141,14 @@ stage: Added - name: Added3990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43157,14 +43157,14 @@ stage: Added - name: Added3992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43172,14 +43172,14 @@ stage: Added - name: Added3994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43187,14 +43187,14 @@ stage: Added - name: Added3996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43202,14 +43202,14 @@ stage: Added - name: Added3998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added3999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43217,7 +43217,7 @@ stage: Added - name: Added4000 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43233,7 +43233,7 @@ stage: Added - name: Added4001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43242,7 +43242,7 @@ stage: Added - name: Modified4002 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43262,7 +43262,7 @@ stage: Modified - name: Added4003 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43278,7 +43278,7 @@ stage: Added - name: Added4004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43287,7 +43287,7 @@ stage: Added - name: Modified4005 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43307,7 +43307,7 @@ stage: Modified - name: Added4006 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43323,7 +43323,7 @@ stage: Added - name: Added4007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43332,7 +43332,7 @@ stage: Added - name: Modified4008 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43352,7 +43352,7 @@ stage: Modified - name: Added4009 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43368,7 +43368,7 @@ stage: Added - name: Added4010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43377,7 +43377,7 @@ stage: Added - name: Modified4011 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43397,7 +43397,7 @@ stage: Modified - name: Added4012 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43413,7 +43413,7 @@ stage: Added - name: Added4013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43421,7 +43421,7 @@ stage: Added - name: Modified4014 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43441,7 +43441,7 @@ stage: Modified - name: Added4015 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43457,7 +43457,7 @@ stage: Added - name: Added4016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43465,7 +43465,7 @@ stage: Added - name: Modified4017 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43485,7 +43485,7 @@ stage: Modified - name: Added4018 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43501,7 +43501,7 @@ stage: Added - name: Added4019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43509,7 +43509,7 @@ stage: Added - name: Modified4020 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43529,7 +43529,7 @@ stage: Modified - name: Added4021 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43545,7 +43545,7 @@ stage: Added - name: Added4022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43553,7 +43553,7 @@ stage: Added - name: Modified4023 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43573,7 +43573,7 @@ stage: Modified - name: Added4024 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1608\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43589,7 +43589,7 @@ stage: Added - name: Added4025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1608\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1608\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43598,7 +43598,7 @@ stage: Added - name: Added4026 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1609\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43614,7 +43614,7 @@ stage: Added - name: Added4027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1609\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1609\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43623,7 +43623,7 @@ stage: Added - name: Added4028 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1610\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43639,7 +43639,7 @@ stage: Added - name: Added4029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1610\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1610\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43648,7 +43648,7 @@ stage: Added - name: Added4030 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1611\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43664,7 +43664,7 @@ stage: Added - name: Added4031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1611\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1611\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43673,7 +43673,7 @@ stage: Added - name: Added4032 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1612\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43689,7 +43689,7 @@ stage: Added - name: Added4033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1612\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1612\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43697,7 +43697,7 @@ stage: Added - name: Added4034 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1613\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43713,7 +43713,7 @@ stage: Added - name: Added4035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1613\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1613\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43721,7 +43721,7 @@ stage: Added - name: Added4036 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1614\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43737,7 +43737,7 @@ stage: Added - name: Added4037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1614\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1614\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43745,7 +43745,7 @@ stage: Added - name: Added4038 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1615\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -43761,7 +43761,7 @@ stage: Added - name: Added4039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1615\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1615\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43769,7 +43769,7 @@ stage: Added - name: Added4040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43777,7 +43777,7 @@ stage: Added - name: Added4041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43786,7 +43786,7 @@ stage: Added - name: Modified4042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43794,7 +43794,7 @@ stage: Modified - name: Added4043 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43802,7 +43802,7 @@ stage: Added - name: Added4044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43811,7 +43811,7 @@ stage: Added - name: Modified4045 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43819,7 +43819,7 @@ stage: Modified - name: Added4046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43827,7 +43827,7 @@ stage: Added - name: Added4047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43836,7 +43836,7 @@ stage: Added - name: Modified4048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43844,7 +43844,7 @@ stage: Modified - name: Added4049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43852,7 +43852,7 @@ stage: Added - name: Added4050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43861,7 +43861,7 @@ stage: Added - name: Modified4051 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43869,7 +43869,7 @@ stage: Modified - name: Added4052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43877,7 +43877,7 @@ stage: Added - name: Added4053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43885,7 +43885,7 @@ stage: Added - name: Modified4054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43893,7 +43893,7 @@ stage: Modified - name: Added4055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43901,7 +43901,7 @@ stage: Added - name: Added4056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43909,7 +43909,7 @@ stage: Added - name: Modified4057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43917,7 +43917,7 @@ stage: Modified - name: Added4058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43925,7 +43925,7 @@ stage: Added - name: Added4059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43933,7 +43933,7 @@ stage: Added - name: Modified4060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43941,7 +43941,7 @@ stage: Modified - name: Added4061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43949,7 +43949,7 @@ stage: Added - name: Added4062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -43957,7 +43957,7 @@ stage: Added - name: Modified4063 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"9902322a377edde75073fec622fb2fa66683859f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -43965,7 +43965,7 @@ stage: Modified - name: Added4064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1624\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1624\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -43973,7 +43973,7 @@ stage: Added - name: Added4065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1624\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1624\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43982,7 +43982,7 @@ stage: Added - name: Added4066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1625\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1625\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -43990,7 +43990,7 @@ stage: Added - name: Added4067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1625\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1625\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -43999,7 +43999,7 @@ stage: Added - name: Added4068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1626\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1626\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -44007,7 +44007,7 @@ stage: Added - name: Added4069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1626\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1626\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44016,7 +44016,7 @@ stage: Added - name: Added4070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1627\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1627\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -44024,7 +44024,7 @@ stage: Added - name: Added4071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1627\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1627\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44033,7 +44033,7 @@ stage: Added - name: Added4072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1628\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1628\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -44041,7 +44041,7 @@ stage: Added - name: Added4073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1628\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1628\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44049,7 +44049,7 @@ stage: Added - name: Added4074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1629\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1629\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -44057,7 +44057,7 @@ stage: Added - name: Added4075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1629\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1629\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44065,7 +44065,7 @@ stage: Added - name: Added4076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1630\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1630\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -44073,7 +44073,7 @@ stage: Added - name: Added4077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1630\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1630\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44081,7 +44081,7 @@ stage: Added - name: Added4078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1631\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1631\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -44089,7 +44089,7 @@ stage: Added - name: Added4079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1631\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1631\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44097,7 +44097,7 @@ stage: Added - name: Added4080 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44112,7 +44112,7 @@ stage: Added - name: Added4081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44121,7 +44121,7 @@ stage: Added - name: Modified4082 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44140,7 +44140,7 @@ stage: Modified - name: Added4083 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44155,7 +44155,7 @@ stage: Added - name: Added4084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44164,7 +44164,7 @@ stage: Added - name: Modified4085 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44183,7 +44183,7 @@ stage: Modified - name: Added4086 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44198,7 +44198,7 @@ stage: Added - name: Added4087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44207,7 +44207,7 @@ stage: Added - name: Modified4088 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44226,7 +44226,7 @@ stage: Modified - name: Added4089 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44241,7 +44241,7 @@ stage: Added - name: Added4090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44250,7 +44250,7 @@ stage: Added - name: Modified4091 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44269,7 +44269,7 @@ stage: Modified - name: Added4092 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44284,7 +44284,7 @@ stage: Added - name: Added4093 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44292,7 +44292,7 @@ stage: Added - name: Modified4094 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44311,7 +44311,7 @@ stage: Modified - name: Added4095 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44326,7 +44326,7 @@ stage: Added - name: Added4096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44334,7 +44334,7 @@ stage: Added - name: Modified4097 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44353,7 +44353,7 @@ stage: Modified - name: Added4098 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44368,7 +44368,7 @@ stage: Added - name: Added4099 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44376,7 +44376,7 @@ stage: Added - name: Modified4100 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44395,7 +44395,7 @@ stage: Modified - name: Added4101 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44410,7 +44410,7 @@ stage: Added - name: Added4102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44418,7 +44418,7 @@ stage: Added - name: Modified4103 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44437,7 +44437,7 @@ stage: Modified - name: Added4104 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1640\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44452,7 +44452,7 @@ stage: Added - name: Added4105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1640\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1640\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44461,7 +44461,7 @@ stage: Added - name: Added4106 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1641\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44476,7 +44476,7 @@ stage: Added - name: Added4107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1641\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1641\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44485,7 +44485,7 @@ stage: Added - name: Added4108 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1642\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44500,7 +44500,7 @@ stage: Added - name: Added4109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1642\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1642\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44509,7 +44509,7 @@ stage: Added - name: Added4110 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1643\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44524,7 +44524,7 @@ stage: Added - name: Added4111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1643\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1643\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44533,7 +44533,7 @@ stage: Added - name: Added4112 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1644\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44548,7 +44548,7 @@ stage: Added - name: Added4113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1644\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1644\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44556,7 +44556,7 @@ stage: Added - name: Added4114 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1645\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44571,7 +44571,7 @@ stage: Added - name: Added4115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1645\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1645\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44579,7 +44579,7 @@ stage: Added - name: Added4116 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1646\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44594,7 +44594,7 @@ stage: Added - name: Added4117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1646\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1646\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44602,7 +44602,7 @@ stage: Added - name: Added4118 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1647\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44617,7 +44617,7 @@ stage: Added - name: Added4119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1647\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1647\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44625,14 +44625,14 @@ stage: Added - name: Added4120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44641,21 +44641,21 @@ stage: Added - name: Modified4122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44664,21 +44664,21 @@ stage: Added - name: Modified4125 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44687,21 +44687,21 @@ stage: Added - name: Modified4128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4129 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44710,21 +44710,21 @@ stage: Added - name: Modified4131 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44732,21 +44732,21 @@ stage: Added - name: Modified4134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4135 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44754,21 +44754,21 @@ stage: Added - name: Modified4137 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44776,21 +44776,21 @@ stage: Added - name: Modified4140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4141 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44798,21 +44798,21 @@ stage: Added - name: Modified4143 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722882,"checksum":"7b9a5cf2ba52f8129ecd3bf9d5efabb4b711e41b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1656\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1656\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1656\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1656\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44821,14 +44821,14 @@ stage: Added - name: Added4146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1657\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1657\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1657\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1657\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44837,14 +44837,14 @@ stage: Added - name: Added4148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1658\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1658\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1658\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1658\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44853,14 +44853,14 @@ stage: Added - name: Added4150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1659\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1659\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1659\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1659\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -44869,14 +44869,14 @@ stage: Added - name: Added4152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1660\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1660\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1660\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1660\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44884,14 +44884,14 @@ stage: Added - name: Added4154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1661\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1661\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1661\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1661\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44899,14 +44899,14 @@ stage: Added - name: Added4156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1662\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1662\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1662\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1662\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44914,14 +44914,14 @@ stage: Added - name: Added4158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1663\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1663\\reg_key", "arch": "[x64]", "timestamp": 1606769877, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1663\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1663\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44929,7 +44929,7 @@ stage: Added - name: Added4160 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44945,7 +44945,7 @@ stage: Added - name: Added4161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44953,7 +44953,7 @@ stage: Added - name: Modified4162 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44973,7 +44973,7 @@ stage: Modified - name: Added4163 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -44989,7 +44989,7 @@ stage: Added - name: Added4164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -44997,7 +44997,7 @@ stage: Added - name: Modified4165 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45017,7 +45017,7 @@ stage: Modified - name: Added4166 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45033,7 +45033,7 @@ stage: Added - name: Added4167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45041,7 +45041,7 @@ stage: Added - name: Modified4168 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45061,7 +45061,7 @@ stage: Modified - name: Added4169 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45077,7 +45077,7 @@ stage: Added - name: Added4170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45085,7 +45085,7 @@ stage: Added - name: Modified4171 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45105,7 +45105,7 @@ stage: Modified - name: Added4172 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769877,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45121,7 +45121,7 @@ stage: Added - name: Added4173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769877,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769877, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45129,7 +45129,7 @@ stage: Added - name: Modified4174 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45149,7 +45149,7 @@ stage: Modified - name: Added4175 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45165,7 +45165,7 @@ stage: Added - name: Added4176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45173,7 +45173,7 @@ stage: Added - name: Modified4177 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45193,7 +45193,7 @@ stage: Modified - name: Added4178 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45209,7 +45209,7 @@ stage: Added - name: Added4179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45217,7 +45217,7 @@ stage: Added - name: Modified4180 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45237,7 +45237,7 @@ stage: Modified - name: Added4181 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45253,7 +45253,7 @@ stage: Added - name: Added4182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45261,7 +45261,7 @@ stage: Added - name: Modified4183 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45281,7 +45281,7 @@ stage: Modified - name: Added4184 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1672\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45297,7 +45297,7 @@ stage: Added - name: Added4185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1672\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1672\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45305,7 +45305,7 @@ stage: Added - name: Added4186 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1673\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45321,7 +45321,7 @@ stage: Added - name: Added4187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1673\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1673\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45329,7 +45329,7 @@ stage: Added - name: Added4188 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1674\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45345,7 +45345,7 @@ stage: Added - name: Added4189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1674\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1674\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45353,7 +45353,7 @@ stage: Added - name: Added4190 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1675\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45369,7 +45369,7 @@ stage: Added - name: Added4191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1675\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1675\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45377,7 +45377,7 @@ stage: Added - name: Added4192 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1676\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45393,7 +45393,7 @@ stage: Added - name: Added4193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1676\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1676\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45401,7 +45401,7 @@ stage: Added - name: Added4194 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1677\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45417,7 +45417,7 @@ stage: Added - name: Added4195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1677\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1677\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45425,7 +45425,7 @@ stage: Added - name: Added4196 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1678\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45441,7 +45441,7 @@ stage: Added - name: Added4197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1678\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1678\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45449,7 +45449,7 @@ stage: Added - name: Added4198 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1679\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45465,7 +45465,7 @@ stage: Added - name: Added4199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1679\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1679\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45473,7 +45473,7 @@ stage: Added - name: Added4200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45481,7 +45481,7 @@ stage: Added - name: Added4201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45489,7 +45489,7 @@ stage: Added - name: Modified4202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45497,7 +45497,7 @@ stage: Modified - name: Added4203 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45505,7 +45505,7 @@ stage: Added - name: Added4204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45513,7 +45513,7 @@ stage: Added - name: Modified4205 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45521,7 +45521,7 @@ stage: Modified - name: Added4206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45529,7 +45529,7 @@ stage: Added - name: Added4207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45537,7 +45537,7 @@ stage: Added - name: Modified4208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45545,7 +45545,7 @@ stage: Modified - name: Added4209 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45553,7 +45553,7 @@ stage: Added - name: Added4210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45561,7 +45561,7 @@ stage: Added - name: Modified4211 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45569,7 +45569,7 @@ stage: Modified - name: Added4212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45577,7 +45577,7 @@ stage: Added - name: Added4213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45585,7 +45585,7 @@ stage: Added - name: Modified4214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45593,7 +45593,7 @@ stage: Modified - name: Added4215 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45601,7 +45601,7 @@ stage: Added - name: Added4216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45609,7 +45609,7 @@ stage: Added - name: Modified4217 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45617,7 +45617,7 @@ stage: Modified - name: Added4218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45625,7 +45625,7 @@ stage: Added - name: Added4219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45633,7 +45633,7 @@ stage: Added - name: Modified4220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45641,7 +45641,7 @@ stage: Modified - name: Added4221 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45649,7 +45649,7 @@ stage: Added - name: Added4222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45657,7 +45657,7 @@ stage: Added - name: Modified4223 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722882,"checksum":"ecb63a10152e4d975fc3e19af523b16ca3ba1c56"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45665,7 +45665,7 @@ stage: Modified - name: Added4224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45673,7 +45673,7 @@ stage: Added - name: Added4225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45681,7 +45681,7 @@ stage: Added - name: Added4226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45689,7 +45689,7 @@ stage: Added - name: Added4227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45697,7 +45697,7 @@ stage: Added - name: Added4228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45705,7 +45705,7 @@ stage: Added - name: Added4229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45713,7 +45713,7 @@ stage: Added - name: Added4230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45721,7 +45721,7 @@ stage: Added - name: Added4231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45729,7 +45729,7 @@ stage: Added - name: Added4232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45737,7 +45737,7 @@ stage: Added - name: Added4233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45745,7 +45745,7 @@ stage: Added - name: Added4234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45753,7 +45753,7 @@ stage: Added - name: Added4235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45761,7 +45761,7 @@ stage: Added - name: Added4236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45769,7 +45769,7 @@ stage: Added - name: Added4237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45777,7 +45777,7 @@ stage: Added - name: Added4238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -45785,7 +45785,7 @@ stage: Added - name: Added4239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45793,7 +45793,7 @@ stage: Added - name: Added4240 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45809,7 +45809,7 @@ stage: Added - name: Added4241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45817,7 +45817,7 @@ stage: Added - name: Modified4242 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45837,7 +45837,7 @@ stage: Modified - name: Added4243 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45853,7 +45853,7 @@ stage: Added - name: Added4244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45861,7 +45861,7 @@ stage: Added - name: Modified4245 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45881,7 +45881,7 @@ stage: Modified - name: Added4246 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45897,7 +45897,7 @@ stage: Added - name: Added4247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45905,7 +45905,7 @@ stage: Added - name: Modified4248 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45925,7 +45925,7 @@ stage: Modified - name: Added4249 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45941,7 +45941,7 @@ stage: Added - name: Added4250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45949,7 +45949,7 @@ stage: Added - name: Modified4251 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45969,7 +45969,7 @@ stage: Modified - name: Added4252 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -45985,7 +45985,7 @@ stage: Added - name: Added4253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -45993,7 +45993,7 @@ stage: Added - name: Modified4254 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46013,7 +46013,7 @@ stage: Modified - name: Added4255 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46029,7 +46029,7 @@ stage: Added - name: Added4256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46037,7 +46037,7 @@ stage: Added - name: Modified4257 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46057,7 +46057,7 @@ stage: Modified - name: Added4258 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46073,7 +46073,7 @@ stage: Added - name: Added4259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46081,7 +46081,7 @@ stage: Added - name: Modified4260 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46101,7 +46101,7 @@ stage: Modified - name: Added4261 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46117,7 +46117,7 @@ stage: Added - name: Added4262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46125,7 +46125,7 @@ stage: Added - name: Modified4263 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46145,7 +46145,7 @@ stage: Modified - name: Added4264 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1704\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46160,7 +46160,7 @@ stage: Added - name: Added4265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1704\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1704\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46168,7 +46168,7 @@ stage: Added - name: Added4266 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1705\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46183,7 +46183,7 @@ stage: Added - name: Added4267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1705\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1705\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46191,7 +46191,7 @@ stage: Added - name: Added4268 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1706\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46206,7 +46206,7 @@ stage: Added - name: Added4269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1706\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1706\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46214,7 +46214,7 @@ stage: Added - name: Added4270 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1707\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46229,7 +46229,7 @@ stage: Added - name: Added4271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1707\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1707\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46237,7 +46237,7 @@ stage: Added - name: Added4272 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1708\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46252,7 +46252,7 @@ stage: Added - name: Added4273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1708\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1708\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46260,7 +46260,7 @@ stage: Added - name: Added4274 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1709\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46275,7 +46275,7 @@ stage: Added - name: Added4275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1709\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1709\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46283,7 +46283,7 @@ stage: Added - name: Added4276 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1710\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46298,7 +46298,7 @@ stage: Added - name: Added4277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1710\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1710\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46306,7 +46306,7 @@ stage: Added - name: Added4278 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1711\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46321,7 +46321,7 @@ stage: Added - name: Added4279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1711\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1711\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46329,7 +46329,7 @@ stage: Added - name: Added4280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46337,7 +46337,7 @@ stage: Added - name: Added4281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46345,7 +46345,7 @@ stage: Added - name: Modified4282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46353,7 +46353,7 @@ stage: Modified - name: Added4283 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46361,7 +46361,7 @@ stage: Added - name: Added4284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46369,7 +46369,7 @@ stage: Added - name: Modified4285 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46377,7 +46377,7 @@ stage: Modified - name: Added4286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46385,7 +46385,7 @@ stage: Added - name: Added4287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46393,7 +46393,7 @@ stage: Added - name: Modified4288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46401,7 +46401,7 @@ stage: Modified - name: Added4289 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46409,7 +46409,7 @@ stage: Added - name: Added4290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46417,7 +46417,7 @@ stage: Added - name: Modified4291 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46425,7 +46425,7 @@ stage: Modified - name: Added4292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46433,7 +46433,7 @@ stage: Added - name: Added4293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46441,7 +46441,7 @@ stage: Added - name: Modified4294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46449,7 +46449,7 @@ stage: Modified - name: Added4295 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46457,7 +46457,7 @@ stage: Added - name: Added4296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46465,7 +46465,7 @@ stage: Added - name: Modified4297 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46473,7 +46473,7 @@ stage: Modified - name: Added4298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46481,7 +46481,7 @@ stage: Added - name: Added4299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46489,7 +46489,7 @@ stage: Added - name: Modified4300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46497,7 +46497,7 @@ stage: Modified - name: Added4301 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46505,7 +46505,7 @@ stage: Added - name: Added4302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46513,7 +46513,7 @@ stage: Added - name: Modified4303 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723053, @@ -46521,14 +46521,14 @@ stage: Modified - name: Added4304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46536,14 +46536,14 @@ stage: Added - name: Added4306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46551,14 +46551,14 @@ stage: Added - name: Added4308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46566,14 +46566,14 @@ stage: Added - name: Added4310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46581,14 +46581,14 @@ stage: Added - name: Added4312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46596,14 +46596,14 @@ stage: Added - name: Added4314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46611,14 +46611,14 @@ stage: Added - name: Added4316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46626,14 +46626,14 @@ stage: Added - name: Added4318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46641,7 +46641,7 @@ stage: Added - name: Added4320 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46657,7 +46657,7 @@ stage: Added - name: Added4321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46665,7 +46665,7 @@ stage: Added - name: Modified4322 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46685,7 +46685,7 @@ stage: Modified - name: Added4323 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46701,7 +46701,7 @@ stage: Added - name: Added4324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46709,7 +46709,7 @@ stage: Added - name: Modified4325 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46729,7 +46729,7 @@ stage: Modified - name: Added4326 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46745,7 +46745,7 @@ stage: Added - name: Added4327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46753,7 +46753,7 @@ stage: Added - name: Modified4328 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46773,7 +46773,7 @@ stage: Modified - name: Added4329 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46789,7 +46789,7 @@ stage: Added - name: Added4330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46797,7 +46797,7 @@ stage: Added - name: Modified4331 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46817,7 +46817,7 @@ stage: Modified - name: Added4332 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46833,7 +46833,7 @@ stage: Added - name: Added4333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46841,7 +46841,7 @@ stage: Added - name: Modified4334 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46861,7 +46861,7 @@ stage: Modified - name: Added4335 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46877,7 +46877,7 @@ stage: Added - name: Added4336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46885,7 +46885,7 @@ stage: Added - name: Modified4337 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46905,7 +46905,7 @@ stage: Modified - name: Added4338 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46921,7 +46921,7 @@ stage: Added - name: Added4339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46929,7 +46929,7 @@ stage: Added - name: Modified4340 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46949,7 +46949,7 @@ stage: Modified - name: Added4341 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46965,7 +46965,7 @@ stage: Added - name: Added4342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -46973,7 +46973,7 @@ stage: Added - name: Modified4343 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -46993,7 +46993,7 @@ stage: Modified - name: Added4344 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1736\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47009,7 +47009,7 @@ stage: Added - name: Added4345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1736\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1736\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47017,7 +47017,7 @@ stage: Added - name: Added4346 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1737\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47033,7 +47033,7 @@ stage: Added - name: Added4347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1737\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1737\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47041,7 +47041,7 @@ stage: Added - name: Added4348 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1738\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47057,7 +47057,7 @@ stage: Added - name: Added4349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1738\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1738\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47065,7 +47065,7 @@ stage: Added - name: Added4350 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1739\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47081,7 +47081,7 @@ stage: Added - name: Added4351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1739\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1739\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47089,7 +47089,7 @@ stage: Added - name: Added4352 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1740\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47105,7 +47105,7 @@ stage: Added - name: Added4353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1740\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1740\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47113,7 +47113,7 @@ stage: Added - name: Added4354 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1741\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47129,7 +47129,7 @@ stage: Added - name: Added4355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1741\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1741\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47137,7 +47137,7 @@ stage: Added - name: Added4356 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1742\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47153,7 +47153,7 @@ stage: Added - name: Added4357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1742\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1742\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47161,7 +47161,7 @@ stage: Added - name: Added4358 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1743\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47177,7 +47177,7 @@ stage: Added - name: Added4359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1743\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1743\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47185,7 +47185,7 @@ stage: Added - name: Added4360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47193,7 +47193,7 @@ stage: Added - name: Added4361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47201,7 +47201,7 @@ stage: Added - name: Modified4362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47209,7 +47209,7 @@ stage: Modified - name: Added4363 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47217,7 +47217,7 @@ stage: Added - name: Added4364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47225,7 +47225,7 @@ stage: Added - name: Modified4365 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47233,7 +47233,7 @@ stage: Modified - name: Added4366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47241,7 +47241,7 @@ stage: Added - name: Added4367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47249,7 +47249,7 @@ stage: Added - name: Modified4368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47257,7 +47257,7 @@ stage: Modified - name: Added4369 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47265,7 +47265,7 @@ stage: Added - name: Added4370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47273,7 +47273,7 @@ stage: Added - name: Modified4371 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47281,7 +47281,7 @@ stage: Modified - name: Added4372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47289,7 +47289,7 @@ stage: Added - name: Added4373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47297,7 +47297,7 @@ stage: Added - name: Modified4374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47305,7 +47305,7 @@ stage: Modified - name: Added4375 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47313,7 +47313,7 @@ stage: Added - name: Added4376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47321,7 +47321,7 @@ stage: Added - name: Modified4377 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47329,7 +47329,7 @@ stage: Modified - name: Added4378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47337,7 +47337,7 @@ stage: Added - name: Added4379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47345,7 +47345,7 @@ stage: Added - name: Modified4380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47353,7 +47353,7 @@ stage: Modified - name: Added4381 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47361,7 +47361,7 @@ stage: Added - name: Added4382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47369,7 +47369,7 @@ stage: Added - name: Modified4383 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -47377,7 +47377,7 @@ stage: Modified - name: Added4384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1752\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1752\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -47385,7 +47385,7 @@ stage: Added - name: Added4385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1752\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1752\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47393,7 +47393,7 @@ stage: Added - name: Added4386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1753\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1753\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -47401,7 +47401,7 @@ stage: Added - name: Added4387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1753\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1753\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47409,7 +47409,7 @@ stage: Added - name: Added4388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1754\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1754\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -47417,7 +47417,7 @@ stage: Added - name: Added4389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1754\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1754\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47425,7 +47425,7 @@ stage: Added - name: Added4390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1755\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1755\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -47433,7 +47433,7 @@ stage: Added - name: Added4391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1755\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1755\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47441,7 +47441,7 @@ stage: Added - name: Added4392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1756\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1756\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -47449,7 +47449,7 @@ stage: Added - name: Added4393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1756\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1756\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47457,7 +47457,7 @@ stage: Added - name: Added4394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1757\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1757\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -47465,7 +47465,7 @@ stage: Added - name: Added4395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1757\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1757\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47473,7 +47473,7 @@ stage: Added - name: Added4396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1758\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1758\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -47481,7 +47481,7 @@ stage: Added - name: Added4397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1758\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1758\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47489,7 +47489,7 @@ stage: Added - name: Added4398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1759\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1759\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -47497,7 +47497,7 @@ stage: Added - name: Added4399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1759\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1759\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47505,7 +47505,7 @@ stage: Added - name: Added4400 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47520,7 +47520,7 @@ stage: Added - name: Added4401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47528,7 +47528,7 @@ stage: Added - name: Modified4402 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47547,7 +47547,7 @@ stage: Modified - name: Added4403 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47562,7 +47562,7 @@ stage: Added - name: Added4404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47570,7 +47570,7 @@ stage: Added - name: Modified4405 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47589,7 +47589,7 @@ stage: Modified - name: Added4406 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47604,7 +47604,7 @@ stage: Added - name: Added4407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47612,7 +47612,7 @@ stage: Added - name: Modified4408 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47631,7 +47631,7 @@ stage: Modified - name: Added4409 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47646,7 +47646,7 @@ stage: Added - name: Added4410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47654,7 +47654,7 @@ stage: Added - name: Modified4411 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47673,7 +47673,7 @@ stage: Modified - name: Added4412 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47688,7 +47688,7 @@ stage: Added - name: Added4413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47696,7 +47696,7 @@ stage: Added - name: Modified4414 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47715,7 +47715,7 @@ stage: Modified - name: Added4415 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47730,7 +47730,7 @@ stage: Added - name: Added4416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47738,7 +47738,7 @@ stage: Added - name: Modified4417 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47757,7 +47757,7 @@ stage: Modified - name: Added4418 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47772,7 +47772,7 @@ stage: Added - name: Added4419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47780,7 +47780,7 @@ stage: Added - name: Modified4420 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47799,7 +47799,7 @@ stage: Modified - name: Added4421 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47814,7 +47814,7 @@ stage: Added - name: Added4422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47822,7 +47822,7 @@ stage: Added - name: Modified4423 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47841,7 +47841,7 @@ stage: Modified - name: Added4424 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1768\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47856,7 +47856,7 @@ stage: Added - name: Added4425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1768\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1768\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47864,7 +47864,7 @@ stage: Added - name: Added4426 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1769\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47879,7 +47879,7 @@ stage: Added - name: Added4427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1769\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1769\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47887,7 +47887,7 @@ stage: Added - name: Added4428 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1770\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47902,7 +47902,7 @@ stage: Added - name: Added4429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1770\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1770\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47910,7 +47910,7 @@ stage: Added - name: Added4430 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1771\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47925,7 +47925,7 @@ stage: Added - name: Added4431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1771\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1771\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47933,7 +47933,7 @@ stage: Added - name: Added4432 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1772\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47948,7 +47948,7 @@ stage: Added - name: Added4433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1772\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1772\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47956,7 +47956,7 @@ stage: Added - name: Added4434 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1773\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47971,7 +47971,7 @@ stage: Added - name: Added4435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1773\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1773\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -47979,7 +47979,7 @@ stage: Added - name: Added4436 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1774\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -47994,7 +47994,7 @@ stage: Added - name: Added4437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1774\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1774\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48002,7 +48002,7 @@ stage: Added - name: Added4438 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1775\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48017,7 +48017,7 @@ stage: Added - name: Added4439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1775\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1775\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48025,14 +48025,14 @@ stage: Added - name: Added4440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48040,21 +48040,21 @@ stage: Added - name: Modified4442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4443 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48062,21 +48062,21 @@ stage: Added - name: Modified4445 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48084,21 +48084,21 @@ stage: Added - name: Modified4448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4449 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48106,21 +48106,21 @@ stage: Added - name: Modified4451 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48128,21 +48128,21 @@ stage: Added - name: Modified4454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4455 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48150,21 +48150,21 @@ stage: Added - name: Modified4457 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48172,21 +48172,21 @@ stage: Added - name: Modified4460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4461 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Added - name: Added4462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48194,21 +48194,21 @@ stage: Added - name: Modified4463 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "mtime": 1606723053, "checksum": "a436eea6a887c4485684ddc11fd034e4af3542b9"}}' stage: Modified - name: Added4464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1784\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1784\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1784\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1784\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48216,14 +48216,14 @@ stage: Added - name: Added4466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1785\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1785\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1785\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1785\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48231,14 +48231,14 @@ stage: Added - name: Added4468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1786\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1786\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1786\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1786\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48246,14 +48246,14 @@ stage: Added - name: Added4470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1787\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1787\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1787\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1787\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48261,14 +48261,14 @@ stage: Added - name: Added4472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1788\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1788\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1788\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1788\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48276,14 +48276,14 @@ stage: Added - name: Added4474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1789\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1789\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1789\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1789\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48291,14 +48291,14 @@ stage: Added - name: Added4476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1790\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1790\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1790\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1790\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48306,14 +48306,14 @@ stage: Added - name: Added4478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1791\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1791\\reg_key", "arch": "[x64]", "timestamp": 1606769878, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1791\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1791\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -48321,7 +48321,7 @@ stage: Added - name: Added4480 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48337,14 +48337,14 @@ stage: Added - name: Added4481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4482 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48364,7 +48364,7 @@ stage: Modified - name: Added4483 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48380,14 +48380,14 @@ stage: Added - name: Added4484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4485 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769878,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48407,7 +48407,7 @@ stage: Modified - name: Added4486 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48423,14 +48423,14 @@ stage: Added - name: Added4487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4488 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48450,7 +48450,7 @@ stage: Modified - name: Added4489 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48466,14 +48466,14 @@ stage: Added - name: Added4490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4491 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48493,7 +48493,7 @@ stage: Modified - name: Added4492 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48509,14 +48509,14 @@ stage: Added - name: Added4493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4494 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48536,7 +48536,7 @@ stage: Modified - name: Added4495 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48552,14 +48552,14 @@ stage: Added - name: Added4496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4497 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48579,7 +48579,7 @@ stage: Modified - name: Added4498 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48595,14 +48595,14 @@ stage: Added - name: Added4499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4500 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48622,7 +48622,7 @@ stage: Modified - name: Added4501 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48638,14 +48638,14 @@ stage: Added - name: Added4502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4503 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48665,7 +48665,7 @@ stage: Modified - name: Added4504 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1800\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48681,14 +48681,14 @@ stage: Added - name: Added4505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1800\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1800\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4506 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1801\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48704,14 +48704,14 @@ stage: Added - name: Added4507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1801\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1801\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4508 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1802\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48727,14 +48727,14 @@ stage: Added - name: Added4509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1802\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1802\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4510 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1803\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48750,14 +48750,14 @@ stage: Added - name: Added4511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1803\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1803\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4512 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1804\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48773,14 +48773,14 @@ stage: Added - name: Added4513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1804\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1804\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4514 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1805\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48796,14 +48796,14 @@ stage: Added - name: Added4515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1805\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1805\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4516 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1806\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48819,14 +48819,14 @@ stage: Added - name: Added4517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1806\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1806\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4518 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1807\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -48842,14 +48842,14 @@ stage: Added - name: Added4519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1807\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1807\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48857,14 +48857,14 @@ stage: Added - name: Added4521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48872,7 +48872,7 @@ stage: Modified - name: Added4523 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48880,14 +48880,14 @@ stage: Added - name: Added4524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4525 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48895,7 +48895,7 @@ stage: Modified - name: Added4526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48903,14 +48903,14 @@ stage: Added - name: Added4527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48918,7 +48918,7 @@ stage: Modified - name: Added4529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48926,14 +48926,14 @@ stage: Added - name: Added4530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4531 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48941,7 +48941,7 @@ stage: Modified - name: Added4532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48949,14 +48949,14 @@ stage: Added - name: Added4533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48964,7 +48964,7 @@ stage: Modified - name: Added4535 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48972,14 +48972,14 @@ stage: Added - name: Added4536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4537 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48987,7 +48987,7 @@ stage: Modified - name: Added4538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -48995,14 +48995,14 @@ stage: Added - name: Added4539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -49010,7 +49010,7 @@ stage: Modified - name: Added4541 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -49018,14 +49018,14 @@ stage: Added - name: Added4542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4543 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -49033,7 +49033,7 @@ stage: Modified - name: Added4544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -49041,14 +49041,14 @@ stage: Added - name: Added4545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -49056,14 +49056,14 @@ stage: Added - name: Added4547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -49071,14 +49071,14 @@ stage: Added - name: Added4549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -49086,14 +49086,14 @@ stage: Added - name: Added4551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -49101,14 +49101,14 @@ stage: Added - name: Added4553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -49116,14 +49116,14 @@ stage: Added - name: Added4555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -49131,14 +49131,14 @@ stage: Added - name: Added4557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -49146,14 +49146,14 @@ stage: Added - name: Added4559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4560 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49169,14 +49169,14 @@ stage: Added - name: Added4561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4562 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49196,7 +49196,7 @@ stage: Modified - name: Added4563 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49212,14 +49212,14 @@ stage: Added - name: Added4564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4565 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49239,7 +49239,7 @@ stage: Modified - name: Added4566 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49255,14 +49255,14 @@ stage: Added - name: Added4567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4568 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49282,7 +49282,7 @@ stage: Modified - name: Added4569 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49298,14 +49298,14 @@ stage: Added - name: Added4570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4571 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49325,7 +49325,7 @@ stage: Modified - name: Added4572 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49341,14 +49341,14 @@ stage: Added - name: Added4573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4574 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49368,7 +49368,7 @@ stage: Modified - name: Added4575 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49384,14 +49384,14 @@ stage: Added - name: Added4576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4577 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49411,7 +49411,7 @@ stage: Modified - name: Added4578 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49427,14 +49427,14 @@ stage: Added - name: Added4579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4580 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49454,7 +49454,7 @@ stage: Modified - name: Added4581 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49470,14 +49470,14 @@ stage: Added - name: Added4582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4583 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49497,7 +49497,7 @@ stage: Modified - name: Added4584 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1832\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49512,14 +49512,14 @@ stage: Added - name: Added4585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1832\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1832\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4586 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1833\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49534,14 +49534,14 @@ stage: Added - name: Added4587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1833\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1833\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4588 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1834\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49556,14 +49556,14 @@ stage: Added - name: Added4589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1834\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1834\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4590 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1835\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49578,14 +49578,14 @@ stage: Added - name: Added4591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1835\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1835\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4592 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1836\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49600,14 +49600,14 @@ stage: Added - name: Added4593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1836\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1836\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4594 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1837\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49622,14 +49622,14 @@ stage: Added - name: Added4595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1837\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1837\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4596 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1838\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49644,14 +49644,14 @@ stage: Added - name: Added4597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1838\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1838\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4598 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1839\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49666,14 +49666,14 @@ stage: Added - name: Added4599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1839\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1839\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49681,14 +49681,14 @@ stage: Added - name: Added4601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49696,7 +49696,7 @@ stage: Modified - name: Added4603 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49704,14 +49704,14 @@ stage: Added - name: Added4604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4605 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49719,7 +49719,7 @@ stage: Modified - name: Added4606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49727,14 +49727,14 @@ stage: Added - name: Added4607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49742,7 +49742,7 @@ stage: Modified - name: Added4609 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49750,14 +49750,14 @@ stage: Added - name: Added4610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4611 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49765,7 +49765,7 @@ stage: Modified - name: Added4612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49773,14 +49773,14 @@ stage: Added - name: Added4613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49788,7 +49788,7 @@ stage: Modified - name: Added4615 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49796,14 +49796,14 @@ stage: Added - name: Added4616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4617 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49811,7 +49811,7 @@ stage: Modified - name: Added4618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49819,14 +49819,14 @@ stage: Added - name: Added4619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49834,7 +49834,7 @@ stage: Modified - name: Added4621 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49842,14 +49842,14 @@ stage: Added - name: Added4622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4623 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -49857,119 +49857,119 @@ stage: Modified - name: Added4624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4640 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -49985,14 +49985,14 @@ stage: Added - name: Added4641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4642 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50012,7 +50012,7 @@ stage: Modified - name: Added4643 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50028,14 +50028,14 @@ stage: Added - name: Added4644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4645 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50055,7 +50055,7 @@ stage: Modified - name: Added4646 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50071,14 +50071,14 @@ stage: Added - name: Added4647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4648 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50098,7 +50098,7 @@ stage: Modified - name: Added4649 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50114,14 +50114,14 @@ stage: Added - name: Added4650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4651 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50141,7 +50141,7 @@ stage: Modified - name: Added4652 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50157,14 +50157,14 @@ stage: Added - name: Added4653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4654 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50184,7 +50184,7 @@ stage: Modified - name: Added4655 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50200,14 +50200,14 @@ stage: Added - name: Added4656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4657 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50227,7 +50227,7 @@ stage: Modified - name: Added4658 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50243,14 +50243,14 @@ stage: Added - name: Added4659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4660 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50270,7 +50270,7 @@ stage: Modified - name: Added4661 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50286,14 +50286,14 @@ stage: Added - name: Added4662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4663 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50313,7 +50313,7 @@ stage: Modified - name: Added4664 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1864\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50329,14 +50329,14 @@ stage: Added - name: Added4665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1864\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1864\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4666 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1865\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50352,14 +50352,14 @@ stage: Added - name: Added4667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1865\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1865\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4668 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1866\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50375,14 +50375,14 @@ stage: Added - name: Added4669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1866\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1866\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4670 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1867\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50398,14 +50398,14 @@ stage: Added - name: Added4671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1867\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1867\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4672 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1868\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50421,14 +50421,14 @@ stage: Added - name: Added4673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1868\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1868\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4674 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1869\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50444,14 +50444,14 @@ stage: Added - name: Added4675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1869\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1869\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4676 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1870\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50467,14 +50467,14 @@ stage: Added - name: Added4677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1870\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1870\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4678 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1871\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50490,14 +50490,14 @@ stage: Added - name: Added4679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1871\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1871\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50505,14 +50505,14 @@ stage: Added - name: Added4681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50520,7 +50520,7 @@ stage: Modified - name: Added4683 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50528,14 +50528,14 @@ stage: Added - name: Added4684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4685 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50543,7 +50543,7 @@ stage: Modified - name: Added4686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50551,14 +50551,14 @@ stage: Added - name: Added4687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50566,7 +50566,7 @@ stage: Modified - name: Added4689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50574,14 +50574,14 @@ stage: Added - name: Added4690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4691 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50589,7 +50589,7 @@ stage: Modified - name: Added4692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50597,14 +50597,14 @@ stage: Added - name: Added4693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50612,7 +50612,7 @@ stage: Modified - name: Added4695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50620,14 +50620,14 @@ stage: Added - name: Added4696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4697 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50635,7 +50635,7 @@ stage: Modified - name: Added4698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50643,14 +50643,14 @@ stage: Added - name: Added4699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50658,7 +50658,7 @@ stage: Modified - name: Added4701 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50666,14 +50666,14 @@ stage: Added - name: Added4702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4703 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -50681,7 +50681,7 @@ stage: Modified - name: Added4704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1880\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1880\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -50689,14 +50689,14 @@ stage: Added - name: Added4705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1880\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1880\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1881\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1881\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -50704,14 +50704,14 @@ stage: Added - name: Added4707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1881\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1881\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1882\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1882\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -50719,14 +50719,14 @@ stage: Added - name: Added4709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1882\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1882\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1883\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1883\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -50734,14 +50734,14 @@ stage: Added - name: Added4711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1883\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1883\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1884\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1884\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -50749,14 +50749,14 @@ stage: Added - name: Added4713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1884\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1884\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1885\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1885\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -50764,14 +50764,14 @@ stage: Added - name: Added4715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1885\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1885\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1886\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1886\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -50779,14 +50779,14 @@ stage: Added - name: Added4717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1886\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1886\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1887\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1887\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -50794,14 +50794,14 @@ stage: Added - name: Added4719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1887\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1887\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4720 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50816,14 +50816,14 @@ stage: Added - name: Added4721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4722 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50842,7 +50842,7 @@ stage: Modified - name: Added4723 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50857,14 +50857,14 @@ stage: Added - name: Added4724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4725 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50883,7 +50883,7 @@ stage: Modified - name: Added4726 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50898,14 +50898,14 @@ stage: Added - name: Added4727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4728 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50924,7 +50924,7 @@ stage: Modified - name: Added4729 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50939,14 +50939,14 @@ stage: Added - name: Added4730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4731 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50965,7 +50965,7 @@ stage: Modified - name: Added4732 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -50980,14 +50980,14 @@ stage: Added - name: Added4733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4734 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51006,7 +51006,7 @@ stage: Modified - name: Added4735 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51021,14 +51021,14 @@ stage: Added - name: Added4736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4737 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51047,7 +51047,7 @@ stage: Modified - name: Added4738 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51062,14 +51062,14 @@ stage: Added - name: Added4739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4740 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51088,7 +51088,7 @@ stage: Modified - name: Added4741 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51103,14 +51103,14 @@ stage: Added - name: Added4742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4743 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51129,7 +51129,7 @@ stage: Modified - name: Added4744 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1896\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51144,14 +51144,14 @@ stage: Added - name: Added4745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1896\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1896\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4746 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1897\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51166,14 +51166,14 @@ stage: Added - name: Added4747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1897\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1897\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4748 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1898\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51188,14 +51188,14 @@ stage: Added - name: Added4749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1898\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1898\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4750 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1899\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51210,14 +51210,14 @@ stage: Added - name: Added4751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1899\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1899\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4752 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1900\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51232,14 +51232,14 @@ stage: Added - name: Added4753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1900\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1900\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4754 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1901\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51254,14 +51254,14 @@ stage: Added - name: Added4755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1901\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1901\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4756 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1902\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51276,14 +51276,14 @@ stage: Added - name: Added4757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1902\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1902\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4758 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1903\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51298,294 +51298,294 @@ stage: Added - name: Added4759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1903\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1903\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Added - name: Added4761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Modified - name: Added4763 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Added - name: Added4764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4765 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Modified - name: Added4766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Added - name: Added4767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Modified - name: Added4769 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Added - name: Added4770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4771 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Modified - name: Added4772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Added - name: Added4773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Modified - name: Added4775 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Added - name: Added4776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4777 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Modified - name: Added4778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Added - name: Added4779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Modified - name: Added4781 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Added - name: Added4782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4783 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "mtime": 1606723054, "checksum": "56780bb3600ebef1f0766ab4a68ca7232a852e39"}}' stage: Modified - name: Added4784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1912\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1912\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1912\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1912\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1913\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1913\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1913\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1913\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1914\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1914\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1914\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1914\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1915\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1915\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1915\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1915\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1916\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1916\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1916\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1916\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1917\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1917\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1917\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1917\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1918\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1918\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1918\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1918\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1919\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1919\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added4799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1919\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1919\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4800 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1920\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51601,14 +51601,14 @@ stage: Added - name: Added4801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1920\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1920\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4802 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1920","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1920","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51628,7 +51628,7 @@ stage: Modified - name: Added4803 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1921\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51644,14 +51644,14 @@ stage: Added - name: Added4804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1921\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1921\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4805 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1921","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1921","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51671,7 +51671,7 @@ stage: Modified - name: Added4806 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1922\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51687,14 +51687,14 @@ stage: Added - name: Added4807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1922\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1922\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4808 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1922","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1922","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51714,7 +51714,7 @@ stage: Modified - name: Added4809 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1923\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51730,14 +51730,14 @@ stage: Added - name: Added4810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1923\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1923\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4811 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1923","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1923","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51757,7 +51757,7 @@ stage: Modified - name: Added4812 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1924\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51773,14 +51773,14 @@ stage: Added - name: Added4813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1924\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1924\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4814 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1924","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1924","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51800,7 +51800,7 @@ stage: Modified - name: Added4815 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1925\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51816,14 +51816,14 @@ stage: Added - name: Added4816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1925\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1925\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4817 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1925","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1925","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51843,7 +51843,7 @@ stage: Modified - name: Added4818 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1926\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51859,14 +51859,14 @@ stage: Added - name: Added4819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1926\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1926\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4820 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1926","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1926","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51886,7 +51886,7 @@ stage: Modified - name: Added4821 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1927\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51902,14 +51902,14 @@ stage: Added - name: Added4822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1927\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1927\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4823 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1927","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1927","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51929,7 +51929,7 @@ stage: Modified - name: Added4824 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1928\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51945,14 +51945,14 @@ stage: Added - name: Added4825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1928\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1928\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4826 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1929\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51968,14 +51968,14 @@ stage: Added - name: Added4827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1929\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1929\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4828 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1930\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -51991,14 +51991,14 @@ stage: Added - name: Added4829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1930\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1930\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4830 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1931\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52014,14 +52014,14 @@ stage: Added - name: Added4831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1931\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1931\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4832 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1932\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52037,14 +52037,14 @@ stage: Added - name: Added4833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1932\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1932\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4834 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1933\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52060,14 +52060,14 @@ stage: Added - name: Added4835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1933\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1933\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4836 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1934\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52083,14 +52083,14 @@ stage: Added - name: Added4837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1934\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1934\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4838 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1935\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52106,14 +52106,14 @@ stage: Added - name: Added4839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1935\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1935\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52121,14 +52121,14 @@ stage: Added - name: Added4841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52136,7 +52136,7 @@ stage: Modified - name: Added4843 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52144,14 +52144,14 @@ stage: Added - name: Added4844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4845 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52159,7 +52159,7 @@ stage: Modified - name: Added4846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52167,14 +52167,14 @@ stage: Added - name: Added4847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52182,7 +52182,7 @@ stage: Modified - name: Added4849 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52190,14 +52190,14 @@ stage: Added - name: Added4850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4851 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52205,7 +52205,7 @@ stage: Modified - name: Added4852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52213,14 +52213,14 @@ stage: Added - name: Added4853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52228,7 +52228,7 @@ stage: Modified - name: Added4855 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52236,14 +52236,14 @@ stage: Added - name: Added4856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4857 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52251,7 +52251,7 @@ stage: Modified - name: Added4858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52259,14 +52259,14 @@ stage: Added - name: Added4859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52274,7 +52274,7 @@ stage: Modified - name: Added4861 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52282,14 +52282,14 @@ stage: Added - name: Added4862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4863 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"f0a8b4a7064d6a819f231aa7acc9405adb0346f6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52297,7 +52297,7 @@ stage: Modified - name: Added4864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1944\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1944\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52305,14 +52305,14 @@ stage: Added - name: Added4865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1944\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1944\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1945\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1945\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52320,14 +52320,14 @@ stage: Added - name: Added4867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1945\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1945\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1946\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1946\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52335,14 +52335,14 @@ stage: Added - name: Added4869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1946\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1946\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1947\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1947\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52350,14 +52350,14 @@ stage: Added - name: Added4871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1947\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1947\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1948\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1948\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52365,14 +52365,14 @@ stage: Added - name: Added4873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1948\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1948\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1949\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1949\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52380,14 +52380,14 @@ stage: Added - name: Added4875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1949\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1949\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1950\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1950\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52395,14 +52395,14 @@ stage: Added - name: Added4877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1950\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1950\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1951\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1951\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -52410,14 +52410,14 @@ stage: Added - name: Added4879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1951\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1951\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4880 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1952\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52433,14 +52433,14 @@ stage: Added - name: Added4881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1952\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1952\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4882 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1952","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1952","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52460,7 +52460,7 @@ stage: Modified - name: Added4883 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1953\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52476,14 +52476,14 @@ stage: Added - name: Added4884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1953\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1953\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4885 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1953","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1953","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52503,7 +52503,7 @@ stage: Modified - name: Added4886 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1954\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52519,14 +52519,14 @@ stage: Added - name: Added4887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1954\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1954\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4888 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1954","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1954","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52546,7 +52546,7 @@ stage: Modified - name: Added4889 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1955\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52562,14 +52562,14 @@ stage: Added - name: Added4890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1955\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1955\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4891 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1955","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1955","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52589,7 +52589,7 @@ stage: Modified - name: Added4892 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1956\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52605,14 +52605,14 @@ stage: Added - name: Added4893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1956\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1956\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4894 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1956","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1956","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52632,7 +52632,7 @@ stage: Modified - name: Added4895 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1957\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52648,14 +52648,14 @@ stage: Added - name: Added4896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1957\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1957\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4897 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1957","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1957","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52675,7 +52675,7 @@ stage: Modified - name: Added4898 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1958\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52691,14 +52691,14 @@ stage: Added - name: Added4899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1958\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1958\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4900 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1958","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1958","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52718,7 +52718,7 @@ stage: Modified - name: Added4901 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1959\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52734,14 +52734,14 @@ stage: Added - name: Added4902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1959\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1959\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4903 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1959","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1959","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52761,7 +52761,7 @@ stage: Modified - name: Added4904 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1960\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52776,14 +52776,14 @@ stage: Added - name: Added4905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1960\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1960\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4906 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1961\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52798,14 +52798,14 @@ stage: Added - name: Added4907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1961\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1961\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4908 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1962\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52820,14 +52820,14 @@ stage: Added - name: Added4909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1962\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1962\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4910 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1963\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52842,14 +52842,14 @@ stage: Added - name: Added4911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1963\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1963\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4912 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1964\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52864,14 +52864,14 @@ stage: Added - name: Added4913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1964\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1964\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4914 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1965\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52886,14 +52886,14 @@ stage: Added - name: Added4915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1965\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1965\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4916 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1966\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52908,14 +52908,14 @@ stage: Added - name: Added4917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1966\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1966\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4918 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1967\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -52930,14 +52930,14 @@ stage: Added - name: Added4919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1967\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1967\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -52945,14 +52945,14 @@ stage: Added - name: Added4921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -52960,7 +52960,7 @@ stage: Modified - name: Added4923 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -52968,14 +52968,14 @@ stage: Added - name: Added4924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4925 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -52983,7 +52983,7 @@ stage: Modified - name: Added4926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -52991,14 +52991,14 @@ stage: Added - name: Added4927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -53006,7 +53006,7 @@ stage: Modified - name: Added4929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -53014,14 +53014,14 @@ stage: Added - name: Added4930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4931 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -53029,7 +53029,7 @@ stage: Modified - name: Added4932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -53037,14 +53037,14 @@ stage: Added - name: Added4933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -53052,7 +53052,7 @@ stage: Modified - name: Added4935 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -53060,14 +53060,14 @@ stage: Added - name: Added4936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4937 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -53075,7 +53075,7 @@ stage: Modified - name: Added4938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -53083,14 +53083,14 @@ stage: Added - name: Added4939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -53098,7 +53098,7 @@ stage: Modified - name: Added4941 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -53106,14 +53106,14 @@ stage: Added - name: Added4942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4943 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722883,"checksum":"6885475a73c8eb58c91c4b72843b2643a4cb5625"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723054, @@ -53121,119 +53121,119 @@ stage: Modified - name: Added4944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1976\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1976\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1976\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1976\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1977\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1977\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1977\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1977\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1978\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1978\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1978\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1978\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1979\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1979\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1979\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1979\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1980\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1980\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1980\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1980\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1981\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1981\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1981\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1981\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1982\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1982\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1982\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1982\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1983\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1983\\reg_key", "arch": "[x64]", "timestamp": 1606769879, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added4959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1983\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1983\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4960 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1984\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53249,14 +53249,14 @@ stage: Added - name: Added4961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1984\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1984\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4962 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1984","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1984","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53276,7 +53276,7 @@ stage: Modified - name: Added4963 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1985\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53292,14 +53292,14 @@ stage: Added - name: Added4964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1985\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1985\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4965 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1985","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1985","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53319,7 +53319,7 @@ stage: Modified - name: Added4966 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1986\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53335,14 +53335,14 @@ stage: Added - name: Added4967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1986\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1986\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4968 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1986","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1986","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53362,7 +53362,7 @@ stage: Modified - name: Added4969 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1987\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53378,14 +53378,14 @@ stage: Added - name: Added4970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1987\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1987\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4971 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1987","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1987","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53405,7 +53405,7 @@ stage: Modified - name: Added4972 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1988\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769879,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53421,14 +53421,14 @@ stage: Added - name: Added4973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1988\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769879,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1988\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769879, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4974 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1988","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1988","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53448,7 +53448,7 @@ stage: Modified - name: Added4975 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1989\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53464,14 +53464,14 @@ stage: Added - name: Added4976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1989\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1989\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4977 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1989","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1989","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53491,7 +53491,7 @@ stage: Modified - name: Added4978 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1990\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53507,14 +53507,14 @@ stage: Added - name: Added4979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1990\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1990\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4980 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1990","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1990","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53534,7 +53534,7 @@ stage: Modified - name: Added4981 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1991\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53550,14 +53550,14 @@ stage: Added - name: Added4982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1991\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1991\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified4983 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1991","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1991","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53577,7 +53577,7 @@ stage: Modified - name: Added4984 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1992\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53593,14 +53593,14 @@ stage: Added - name: Added4985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1992\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1992\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4986 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1993\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53616,14 +53616,14 @@ stage: Added - name: Added4987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1993\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1993\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4988 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1994\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53639,14 +53639,14 @@ stage: Added - name: Added4989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1994\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1994\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4990 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1995\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53662,14 +53662,14 @@ stage: Added - name: Added4991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1995\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1995\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4992 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1996\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53685,14 +53685,14 @@ stage: Added - name: Added4993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1996\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1996\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4994 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1997\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53708,14 +53708,14 @@ stage: Added - name: Added4995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1997\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1997\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4996 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1998\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53731,14 +53731,14 @@ stage: Added - name: Added4997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1998\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1998\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added4998 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1999\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -53754,14 +53754,14 @@ stage: Added - name: Added4999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1999\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1999\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53769,14 +53769,14 @@ stage: Added - name: Added5001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53784,7 +53784,7 @@ stage: Modified - name: Added5003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53792,14 +53792,14 @@ stage: Added - name: Added5004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5005 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53807,7 +53807,7 @@ stage: Modified - name: Added5006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53815,14 +53815,14 @@ stage: Added - name: Added5007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53830,7 +53830,7 @@ stage: Modified - name: Added5009 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53838,14 +53838,14 @@ stage: Added - name: Added5010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5011 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53853,7 +53853,7 @@ stage: Modified - name: Added5012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53861,14 +53861,14 @@ stage: Added - name: Added5013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53876,7 +53876,7 @@ stage: Modified - name: Added5015 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53884,14 +53884,14 @@ stage: Added - name: Added5016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5017 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53899,7 +53899,7 @@ stage: Modified - name: Added5018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53907,14 +53907,14 @@ stage: Added - name: Added5019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53922,7 +53922,7 @@ stage: Modified - name: Added5021 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53930,14 +53930,14 @@ stage: Added - name: Added5022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5023 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722883,"checksum":"19662f2cc0fae3e63982a961207b4455d0998da1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -53945,7 +53945,7 @@ stage: Modified - name: Added5024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2008\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2008\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -53953,14 +53953,14 @@ stage: Added - name: Added5025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2008\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2008\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2009\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2009\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -53968,14 +53968,14 @@ stage: Added - name: Added5027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2009\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2009\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2010\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2010\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -53983,14 +53983,14 @@ stage: Added - name: Added5029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2010\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2010\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2011\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2011\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -53998,14 +53998,14 @@ stage: Added - name: Added5031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2011\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2011\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2012\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2012\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -54013,14 +54013,14 @@ stage: Added - name: Added5033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2012\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2012\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2013\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2013\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -54028,14 +54028,14 @@ stage: Added - name: Added5035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2013\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2013\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2014\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2014\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -54043,14 +54043,14 @@ stage: Added - name: Added5037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2014\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2014\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2015\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2015\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -54058,14 +54058,14 @@ stage: Added - name: Added5039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2015\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2015\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5040 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2016\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54080,14 +54080,14 @@ stage: Added - name: Added5041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2016\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2016\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5042 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2016","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2016","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54106,7 +54106,7 @@ stage: Modified - name: Added5043 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2017\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54121,14 +54121,14 @@ stage: Added - name: Added5044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2017\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2017\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5045 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2017","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2017","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54147,7 +54147,7 @@ stage: Modified - name: Added5046 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2018\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54162,14 +54162,14 @@ stage: Added - name: Added5047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2018\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2018\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5048 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2018","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2018","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54188,7 +54188,7 @@ stage: Modified - name: Added5049 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2019\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54203,14 +54203,14 @@ stage: Added - name: Added5050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2019\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2019\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5051 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2019","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2019","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54229,7 +54229,7 @@ stage: Modified - name: Added5052 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2020\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54244,14 +54244,14 @@ stage: Added - name: Added5053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2020\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2020\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5054 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2020","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2020","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54270,7 +54270,7 @@ stage: Modified - name: Added5055 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2021\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54285,14 +54285,14 @@ stage: Added - name: Added5056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2021\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2021\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5057 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2021","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2021","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54311,7 +54311,7 @@ stage: Modified - name: Added5058 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2022\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54326,14 +54326,14 @@ stage: Added - name: Added5059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2022\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2022\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5060 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2022","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2022","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54352,7 +54352,7 @@ stage: Modified - name: Added5061 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2023\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54367,14 +54367,14 @@ stage: Added - name: Added5062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2023\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2023\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5063 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2023","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2023","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54393,7 +54393,7 @@ stage: Modified - name: Added5064 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2024\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54408,14 +54408,14 @@ stage: Added - name: Added5065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2024\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2024\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5066 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2025\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54430,14 +54430,14 @@ stage: Added - name: Added5067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2025\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2025\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5068 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2026\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54452,14 +54452,14 @@ stage: Added - name: Added5069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2026\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2026\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5070 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2027\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54474,14 +54474,14 @@ stage: Added - name: Added5071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2027\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2027\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5072 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2028\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54496,14 +54496,14 @@ stage: Added - name: Added5073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2028\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2028\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5074 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2029\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54518,14 +54518,14 @@ stage: Added - name: Added5075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2029\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2029\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5076 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2030\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54540,14 +54540,14 @@ stage: Added - name: Added5077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2030\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2030\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5078 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2031\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54562,294 +54562,294 @@ stage: Added - name: Added5079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2031\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2031\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5083 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5085 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5089 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5091 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5093 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5095 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5097 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5099 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5101 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified5103 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722883,"checksum":"7a37c299ec179c8fd0bf1eb038f19ed0777b9ee7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2040\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2040\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2040\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2040\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2041\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2041\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2041\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2041\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2042\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2042\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2042\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2042\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2043\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2043\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2043\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2043\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2044\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2044\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2044\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2044\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2045\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2045\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2045\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2045\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2046\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2046\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2046\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2046\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2047\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2047\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2047\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2047\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added5120 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54865,7 +54865,7 @@ stage: Added - name: Added5121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -54874,7 +54874,7 @@ stage: Added - name: Modified5122 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54894,7 +54894,7 @@ stage: Modified - name: Added5123 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54910,7 +54910,7 @@ stage: Added - name: Added5124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -54919,7 +54919,7 @@ stage: Added - name: Modified5125 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54939,7 +54939,7 @@ stage: Modified - name: Added5126 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54955,7 +54955,7 @@ stage: Added - name: Added5127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -54964,7 +54964,7 @@ stage: Added - name: Modified5128 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -54984,7 +54984,7 @@ stage: Modified - name: Added5129 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55000,7 +55000,7 @@ stage: Added - name: Added5130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55009,7 +55009,7 @@ stage: Added - name: Modified5131 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55029,7 +55029,7 @@ stage: Modified - name: Added5132 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55045,7 +55045,7 @@ stage: Added - name: Added5133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55054,7 +55054,7 @@ stage: Added - name: Modified5134 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55074,7 +55074,7 @@ stage: Modified - name: Added5135 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55090,7 +55090,7 @@ stage: Added - name: Added5136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55099,7 +55099,7 @@ stage: Added - name: Modified5137 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55119,7 +55119,7 @@ stage: Modified - name: Added5138 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55135,7 +55135,7 @@ stage: Added - name: Added5139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55144,7 +55144,7 @@ stage: Added - name: Modified5140 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55164,7 +55164,7 @@ stage: Modified - name: Added5141 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55180,7 +55180,7 @@ stage: Added - name: Added5142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55189,7 +55189,7 @@ stage: Added - name: Modified5143 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55209,7 +55209,7 @@ stage: Modified - name: Added5144 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2056\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55225,7 +55225,7 @@ stage: Added - name: Added5145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2056\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2056\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55234,7 +55234,7 @@ stage: Added - name: Added5146 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2057\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55250,7 +55250,7 @@ stage: Added - name: Added5147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2057\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2057\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55259,7 +55259,7 @@ stage: Added - name: Added5148 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2058\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55275,7 +55275,7 @@ stage: Added - name: Added5149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2058\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2058\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55284,7 +55284,7 @@ stage: Added - name: Added5150 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2059\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55300,7 +55300,7 @@ stage: Added - name: Added5151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2059\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2059\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55309,7 +55309,7 @@ stage: Added - name: Added5152 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2060\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55325,7 +55325,7 @@ stage: Added - name: Added5153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2060\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2060\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55334,7 +55334,7 @@ stage: Added - name: Added5154 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2061\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55350,7 +55350,7 @@ stage: Added - name: Added5155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2061\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2061\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55359,7 +55359,7 @@ stage: Added - name: Added5156 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2062\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55375,7 +55375,7 @@ stage: Added - name: Added5157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2062\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2062\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55384,7 +55384,7 @@ stage: Added - name: Added5158 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2063\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55400,7 +55400,7 @@ stage: Added - name: Added5159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2063\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2063\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55409,7 +55409,7 @@ stage: Added - name: Added5160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55417,7 +55417,7 @@ stage: Added - name: Added5161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55426,7 +55426,7 @@ stage: Added - name: Modified5162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55434,7 +55434,7 @@ stage: Modified - name: Added5163 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55442,7 +55442,7 @@ stage: Added - name: Added5164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55451,7 +55451,7 @@ stage: Added - name: Modified5165 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55459,7 +55459,7 @@ stage: Modified - name: Added5166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55467,7 +55467,7 @@ stage: Added - name: Added5167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55476,7 +55476,7 @@ stage: Added - name: Modified5168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55484,7 +55484,7 @@ stage: Modified - name: Added5169 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55492,7 +55492,7 @@ stage: Added - name: Added5170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55501,7 +55501,7 @@ stage: Added - name: Modified5171 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55509,7 +55509,7 @@ stage: Modified - name: Added5172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55517,7 +55517,7 @@ stage: Added - name: Added5173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55526,7 +55526,7 @@ stage: Added - name: Modified5174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55534,7 +55534,7 @@ stage: Modified - name: Added5175 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55542,7 +55542,7 @@ stage: Added - name: Added5176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55551,7 +55551,7 @@ stage: Added - name: Modified5177 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55559,7 +55559,7 @@ stage: Modified - name: Added5178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55567,7 +55567,7 @@ stage: Added - name: Added5179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55576,7 +55576,7 @@ stage: Added - name: Modified5180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55584,7 +55584,7 @@ stage: Modified - name: Added5181 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55592,7 +55592,7 @@ stage: Added - name: Added5182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55601,7 +55601,7 @@ stage: Added - name: Modified5183 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55609,7 +55609,7 @@ stage: Modified - name: Added5184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55617,7 +55617,7 @@ stage: Added - name: Added5185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55626,7 +55626,7 @@ stage: Added - name: Added5186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55634,7 +55634,7 @@ stage: Added - name: Added5187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55643,7 +55643,7 @@ stage: Added - name: Added5188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55651,7 +55651,7 @@ stage: Added - name: Added5189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55660,7 +55660,7 @@ stage: Added - name: Added5190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55668,7 +55668,7 @@ stage: Added - name: Added5191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55677,7 +55677,7 @@ stage: Added - name: Added5192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55685,7 +55685,7 @@ stage: Added - name: Added5193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55694,7 +55694,7 @@ stage: Added - name: Added5194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55702,7 +55702,7 @@ stage: Added - name: Added5195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55711,7 +55711,7 @@ stage: Added - name: Added5196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55719,7 +55719,7 @@ stage: Added - name: Added5197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55728,7 +55728,7 @@ stage: Added - name: Added5198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -55736,7 +55736,7 @@ stage: Added - name: Added5199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55745,7 +55745,7 @@ stage: Added - name: Added5200 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55761,7 +55761,7 @@ stage: Added - name: Added5201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55770,7 +55770,7 @@ stage: Added - name: Modified5202 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55790,7 +55790,7 @@ stage: Modified - name: Added5203 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55806,7 +55806,7 @@ stage: Added - name: Added5204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55815,7 +55815,7 @@ stage: Added - name: Modified5205 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55835,7 +55835,7 @@ stage: Modified - name: Added5206 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55851,7 +55851,7 @@ stage: Added - name: Added5207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55860,7 +55860,7 @@ stage: Added - name: Modified5208 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55880,7 +55880,7 @@ stage: Modified - name: Added5209 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55896,7 +55896,7 @@ stage: Added - name: Added5210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55905,7 +55905,7 @@ stage: Added - name: Modified5211 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55925,7 +55925,7 @@ stage: Modified - name: Added5212 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55941,7 +55941,7 @@ stage: Added - name: Added5213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55950,7 +55950,7 @@ stage: Added - name: Modified5214 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55970,7 +55970,7 @@ stage: Modified - name: Added5215 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -55986,7 +55986,7 @@ stage: Added - name: Added5216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -55995,7 +55995,7 @@ stage: Added - name: Modified5217 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56015,7 +56015,7 @@ stage: Modified - name: Added5218 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56031,7 +56031,7 @@ stage: Added - name: Added5219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56040,7 +56040,7 @@ stage: Added - name: Modified5220 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56060,7 +56060,7 @@ stage: Modified - name: Added5221 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56076,7 +56076,7 @@ stage: Added - name: Added5222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56085,7 +56085,7 @@ stage: Added - name: Modified5223 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56105,7 +56105,7 @@ stage: Modified - name: Added5224 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2088\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56120,7 +56120,7 @@ stage: Added - name: Added5225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2088\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2088\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56129,7 +56129,7 @@ stage: Added - name: Added5226 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2089\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56144,7 +56144,7 @@ stage: Added - name: Added5227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2089\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2089\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56153,7 +56153,7 @@ stage: Added - name: Added5228 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2090\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56168,7 +56168,7 @@ stage: Added - name: Added5229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2090\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2090\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56177,7 +56177,7 @@ stage: Added - name: Added5230 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2091\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56192,7 +56192,7 @@ stage: Added - name: Added5231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2091\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2091\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56201,7 +56201,7 @@ stage: Added - name: Added5232 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2092\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56216,7 +56216,7 @@ stage: Added - name: Added5233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2092\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2092\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56225,7 +56225,7 @@ stage: Added - name: Added5234 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2093\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56240,7 +56240,7 @@ stage: Added - name: Added5235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2093\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2093\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56249,7 +56249,7 @@ stage: Added - name: Added5236 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2094\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56264,7 +56264,7 @@ stage: Added - name: Added5237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2094\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2094\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56273,7 +56273,7 @@ stage: Added - name: Added5238 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2095\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56288,7 +56288,7 @@ stage: Added - name: Added5239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2095\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2095\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56297,7 +56297,7 @@ stage: Added - name: Added5240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56305,7 +56305,7 @@ stage: Added - name: Added5241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56314,7 +56314,7 @@ stage: Added - name: Modified5242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56322,7 +56322,7 @@ stage: Modified - name: Added5243 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56330,7 +56330,7 @@ stage: Added - name: Added5244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56339,7 +56339,7 @@ stage: Added - name: Modified5245 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56347,7 +56347,7 @@ stage: Modified - name: Added5246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56355,7 +56355,7 @@ stage: Added - name: Added5247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56364,7 +56364,7 @@ stage: Added - name: Modified5248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56372,7 +56372,7 @@ stage: Modified - name: Added5249 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56380,7 +56380,7 @@ stage: Added - name: Added5250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56389,7 +56389,7 @@ stage: Added - name: Modified5251 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56397,7 +56397,7 @@ stage: Modified - name: Added5252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56405,7 +56405,7 @@ stage: Added - name: Added5253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56414,7 +56414,7 @@ stage: Added - name: Modified5254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56422,7 +56422,7 @@ stage: Modified - name: Added5255 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56430,7 +56430,7 @@ stage: Added - name: Added5256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56439,7 +56439,7 @@ stage: Added - name: Modified5257 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56447,7 +56447,7 @@ stage: Modified - name: Added5258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56455,7 +56455,7 @@ stage: Added - name: Added5259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56464,7 +56464,7 @@ stage: Added - name: Modified5260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56472,7 +56472,7 @@ stage: Modified - name: Added5261 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56480,7 +56480,7 @@ stage: Added - name: Added5262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56489,7 +56489,7 @@ stage: Added - name: Modified5263 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723055, @@ -56497,14 +56497,14 @@ stage: Modified - name: Added5264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56513,14 +56513,14 @@ stage: Added - name: Added5266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56529,14 +56529,14 @@ stage: Added - name: Added5268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56545,14 +56545,14 @@ stage: Added - name: Added5270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56561,14 +56561,14 @@ stage: Added - name: Added5272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56577,14 +56577,14 @@ stage: Added - name: Added5274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56593,14 +56593,14 @@ stage: Added - name: Added5276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56609,14 +56609,14 @@ stage: Added - name: Added5278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56625,7 +56625,7 @@ stage: Added - name: Added5280 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56641,7 +56641,7 @@ stage: Added - name: Added5281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56650,7 +56650,7 @@ stage: Added - name: Modified5282 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56670,7 +56670,7 @@ stage: Modified - name: Added5283 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56686,7 +56686,7 @@ stage: Added - name: Added5284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56695,7 +56695,7 @@ stage: Added - name: Modified5285 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56715,7 +56715,7 @@ stage: Modified - name: Added5286 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56731,7 +56731,7 @@ stage: Added - name: Added5287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56740,7 +56740,7 @@ stage: Added - name: Modified5288 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56760,7 +56760,7 @@ stage: Modified - name: Added5289 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56776,7 +56776,7 @@ stage: Added - name: Added5290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56785,7 +56785,7 @@ stage: Added - name: Modified5291 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56805,7 +56805,7 @@ stage: Modified - name: Added5292 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56821,7 +56821,7 @@ stage: Added - name: Added5293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56830,7 +56830,7 @@ stage: Added - name: Modified5294 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56850,7 +56850,7 @@ stage: Modified - name: Added5295 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56866,7 +56866,7 @@ stage: Added - name: Added5296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56875,7 +56875,7 @@ stage: Added - name: Modified5297 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56895,7 +56895,7 @@ stage: Modified - name: Added5298 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56911,7 +56911,7 @@ stage: Added - name: Added5299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56920,7 +56920,7 @@ stage: Added - name: Modified5300 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56940,7 +56940,7 @@ stage: Modified - name: Added5301 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56956,7 +56956,7 @@ stage: Added - name: Added5302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -56965,7 +56965,7 @@ stage: Added - name: Modified5303 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -56985,7 +56985,7 @@ stage: Modified - name: Added5304 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2120\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57001,7 +57001,7 @@ stage: Added - name: Added5305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2120\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2120\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57010,7 +57010,7 @@ stage: Added - name: Added5306 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2121\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57026,7 +57026,7 @@ stage: Added - name: Added5307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2121\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2121\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57035,7 +57035,7 @@ stage: Added - name: Added5308 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2122\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57051,7 +57051,7 @@ stage: Added - name: Added5309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2122\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2122\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57060,7 +57060,7 @@ stage: Added - name: Added5310 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2123\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57076,7 +57076,7 @@ stage: Added - name: Added5311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2123\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2123\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57085,7 +57085,7 @@ stage: Added - name: Added5312 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2124\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57101,7 +57101,7 @@ stage: Added - name: Added5313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2124\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2124\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57110,7 +57110,7 @@ stage: Added - name: Added5314 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2125\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57126,7 +57126,7 @@ stage: Added - name: Added5315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2125\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2125\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57135,7 +57135,7 @@ stage: Added - name: Added5316 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2126\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57151,7 +57151,7 @@ stage: Added - name: Added5317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2126\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2126\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57160,7 +57160,7 @@ stage: Added - name: Added5318 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2127\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57176,7 +57176,7 @@ stage: Added - name: Added5319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2127\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2127\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57185,7 +57185,7 @@ stage: Added - name: Added5320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57193,7 +57193,7 @@ stage: Added - name: Added5321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57202,7 +57202,7 @@ stage: Added - name: Modified5322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57210,7 +57210,7 @@ stage: Modified - name: Added5323 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57218,7 +57218,7 @@ stage: Added - name: Added5324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57227,7 +57227,7 @@ stage: Added - name: Modified5325 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57235,7 +57235,7 @@ stage: Modified - name: Added5326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57243,7 +57243,7 @@ stage: Added - name: Added5327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57252,7 +57252,7 @@ stage: Added - name: Modified5328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57260,7 +57260,7 @@ stage: Modified - name: Added5329 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57268,7 +57268,7 @@ stage: Added - name: Added5330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57277,7 +57277,7 @@ stage: Added - name: Modified5331 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57285,7 +57285,7 @@ stage: Modified - name: Added5332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57293,7 +57293,7 @@ stage: Added - name: Added5333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57302,7 +57302,7 @@ stage: Added - name: Modified5334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57310,7 +57310,7 @@ stage: Modified - name: Added5335 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57318,7 +57318,7 @@ stage: Added - name: Added5336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57327,7 +57327,7 @@ stage: Added - name: Modified5337 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57335,7 +57335,7 @@ stage: Modified - name: Added5338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57343,7 +57343,7 @@ stage: Added - name: Added5339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57352,7 +57352,7 @@ stage: Added - name: Modified5340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57360,7 +57360,7 @@ stage: Modified - name: Added5341 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57368,7 +57368,7 @@ stage: Added - name: Added5342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57377,7 +57377,7 @@ stage: Added - name: Modified5343 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -57385,7 +57385,7 @@ stage: Modified - name: Added5344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2136\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2136\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -57393,7 +57393,7 @@ stage: Added - name: Added5345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2136\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2136\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57402,7 +57402,7 @@ stage: Added - name: Added5346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2137\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2137\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -57410,7 +57410,7 @@ stage: Added - name: Added5347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2137\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2137\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57419,7 +57419,7 @@ stage: Added - name: Added5348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2138\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2138\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -57427,7 +57427,7 @@ stage: Added - name: Added5349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2138\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2138\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57436,7 +57436,7 @@ stage: Added - name: Added5350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2139\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2139\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -57444,7 +57444,7 @@ stage: Added - name: Added5351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2139\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2139\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57453,7 +57453,7 @@ stage: Added - name: Added5352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2140\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2140\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -57461,7 +57461,7 @@ stage: Added - name: Added5353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2140\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2140\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57470,7 +57470,7 @@ stage: Added - name: Added5354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2141\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2141\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -57478,7 +57478,7 @@ stage: Added - name: Added5355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2141\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2141\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57487,7 +57487,7 @@ stage: Added - name: Added5356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2142\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2142\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -57495,7 +57495,7 @@ stage: Added - name: Added5357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2142\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2142\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57504,7 +57504,7 @@ stage: Added - name: Added5358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2143\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2143\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -57512,7 +57512,7 @@ stage: Added - name: Added5359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2143\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2143\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57521,7 +57521,7 @@ stage: Added - name: Added5360 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57536,7 +57536,7 @@ stage: Added - name: Added5361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57545,7 +57545,7 @@ stage: Added - name: Modified5362 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57564,7 +57564,7 @@ stage: Modified - name: Added5363 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57579,7 +57579,7 @@ stage: Added - name: Added5364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57588,7 +57588,7 @@ stage: Added - name: Modified5365 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57607,7 +57607,7 @@ stage: Modified - name: Added5366 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57622,7 +57622,7 @@ stage: Added - name: Added5367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57631,7 +57631,7 @@ stage: Added - name: Modified5368 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57650,7 +57650,7 @@ stage: Modified - name: Added5369 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57665,7 +57665,7 @@ stage: Added - name: Added5370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57674,7 +57674,7 @@ stage: Added - name: Modified5371 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57693,7 +57693,7 @@ stage: Modified - name: Added5372 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57708,7 +57708,7 @@ stage: Added - name: Added5373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57717,7 +57717,7 @@ stage: Added - name: Modified5374 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57736,7 +57736,7 @@ stage: Modified - name: Added5375 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57751,7 +57751,7 @@ stage: Added - name: Added5376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57760,7 +57760,7 @@ stage: Added - name: Modified5377 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57779,7 +57779,7 @@ stage: Modified - name: Added5378 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57794,7 +57794,7 @@ stage: Added - name: Added5379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57803,7 +57803,7 @@ stage: Added - name: Modified5380 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57822,7 +57822,7 @@ stage: Modified - name: Added5381 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57837,7 +57837,7 @@ stage: Added - name: Added5382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57846,7 +57846,7 @@ stage: Added - name: Modified5383 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57865,7 +57865,7 @@ stage: Modified - name: Added5384 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2152\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57880,7 +57880,7 @@ stage: Added - name: Added5385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2152\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2152\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57889,7 +57889,7 @@ stage: Added - name: Added5386 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2153\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57904,7 +57904,7 @@ stage: Added - name: Added5387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2153\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2153\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57913,7 +57913,7 @@ stage: Added - name: Added5388 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2154\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57928,7 +57928,7 @@ stage: Added - name: Added5389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2154\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2154\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57937,7 +57937,7 @@ stage: Added - name: Added5390 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2155\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57952,7 +57952,7 @@ stage: Added - name: Added5391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2155\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2155\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57961,7 +57961,7 @@ stage: Added - name: Added5392 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2156\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -57976,7 +57976,7 @@ stage: Added - name: Added5393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2156\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2156\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -57985,7 +57985,7 @@ stage: Added - name: Added5394 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2157\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58000,7 +58000,7 @@ stage: Added - name: Added5395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2157\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2157\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58009,7 +58009,7 @@ stage: Added - name: Added5396 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2158\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58024,7 +58024,7 @@ stage: Added - name: Added5397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2158\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2158\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58033,7 +58033,7 @@ stage: Added - name: Added5398 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2159\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58048,7 +58048,7 @@ stage: Added - name: Added5399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2159\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2159\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58057,14 +58057,14 @@ stage: Added - name: Added5400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58073,21 +58073,21 @@ stage: Added - name: Modified5402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58096,21 +58096,21 @@ stage: Added - name: Modified5405 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58119,21 +58119,21 @@ stage: Added - name: Modified5408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58142,21 +58142,21 @@ stage: Added - name: Modified5411 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58165,21 +58165,21 @@ stage: Added - name: Modified5414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58188,21 +58188,21 @@ stage: Added - name: Modified5417 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58211,21 +58211,21 @@ stage: Added - name: Modified5420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5421 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Added - name: Added5422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58234,21 +58234,21 @@ stage: Added - name: Modified5423 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "mtime": 1606723055, "checksum": "a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}' stage: Modified - name: Added5424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2168\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2168\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2168\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2168\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58257,14 +58257,14 @@ stage: Added - name: Added5426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2169\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2169\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2169\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2169\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58273,14 +58273,14 @@ stage: Added - name: Added5428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2170\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2170\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2170\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2170\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58289,14 +58289,14 @@ stage: Added - name: Added5430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2171\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2171\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2171\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2171\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58305,14 +58305,14 @@ stage: Added - name: Added5432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2172\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2172\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2172\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2172\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58321,14 +58321,14 @@ stage: Added - name: Added5434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2173\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2173\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2173\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2173\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58337,14 +58337,14 @@ stage: Added - name: Added5436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2174\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2174\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2174\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2174\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58353,14 +58353,14 @@ stage: Added - name: Added5438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2175\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2175\\reg_key", "arch": "[x64]", "timestamp": 1606769880, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2175\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2175\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58369,7 +58369,7 @@ stage: Added - name: Added5440 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58385,7 +58385,7 @@ stage: Added - name: Added5441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58394,7 +58394,7 @@ stage: Added - name: Modified5442 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58414,7 +58414,7 @@ stage: Modified - name: Added5443 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58430,7 +58430,7 @@ stage: Added - name: Added5444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58439,7 +58439,7 @@ stage: Added - name: Modified5445 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58459,7 +58459,7 @@ stage: Modified - name: Added5446 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58475,7 +58475,7 @@ stage: Added - name: Added5447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58484,7 +58484,7 @@ stage: Added - name: Modified5448 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58504,7 +58504,7 @@ stage: Modified - name: Added5449 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58520,7 +58520,7 @@ stage: Added - name: Added5450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58529,7 +58529,7 @@ stage: Added - name: Modified5451 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58549,7 +58549,7 @@ stage: Modified - name: Added5452 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58565,7 +58565,7 @@ stage: Added - name: Added5453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -58574,7 +58574,7 @@ stage: Added - name: Modified5454 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58594,7 +58594,7 @@ stage: Modified - name: Added5455 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58610,7 +58610,7 @@ stage: Added - name: Added5456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -58619,7 +58619,7 @@ stage: Added - name: Modified5457 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58639,7 +58639,7 @@ stage: Modified - name: Added5458 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58655,7 +58655,7 @@ stage: Added - name: Added5459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -58664,7 +58664,7 @@ stage: Added - name: Modified5460 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58684,7 +58684,7 @@ stage: Modified - name: Added5461 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58700,7 +58700,7 @@ stage: Added - name: Added5462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -58709,7 +58709,7 @@ stage: Added - name: Modified5463 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58729,7 +58729,7 @@ stage: Modified - name: Added5464 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2184\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58745,7 +58745,7 @@ stage: Added - name: Added5465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2184\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2184\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58754,7 +58754,7 @@ stage: Added - name: Added5466 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2185\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769880,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58770,7 +58770,7 @@ stage: Added - name: Added5467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2185\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2185\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58779,7 +58779,7 @@ stage: Added - name: Added5468 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2186\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58795,7 +58795,7 @@ stage: Added - name: Added5469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2186\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2186\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58804,7 +58804,7 @@ stage: Added - name: Added5470 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2187\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58820,7 +58820,7 @@ stage: Added - name: Added5471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2187\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2187\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58829,7 +58829,7 @@ stage: Added - name: Added5472 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2188\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58845,7 +58845,7 @@ stage: Added - name: Added5473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2188\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2188\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -58854,7 +58854,7 @@ stage: Added - name: Added5474 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2189\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58870,7 +58870,7 @@ stage: Added - name: Added5475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2189\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2189\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -58879,7 +58879,7 @@ stage: Added - name: Added5476 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2190\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58895,7 +58895,7 @@ stage: Added - name: Added5477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2190\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2190\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -58904,7 +58904,7 @@ stage: Added - name: Added5478 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2191\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -58920,7 +58920,7 @@ stage: Added - name: Added5479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2191\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2191\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -58929,7 +58929,7 @@ stage: Added - name: Added5480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -58937,7 +58937,7 @@ stage: Added - name: Added5481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58946,7 +58946,7 @@ stage: Added - name: Modified5482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -58954,7 +58954,7 @@ stage: Modified - name: Added5483 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -58962,7 +58962,7 @@ stage: Added - name: Added5484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58971,7 +58971,7 @@ stage: Added - name: Modified5485 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -58979,7 +58979,7 @@ stage: Modified - name: Added5486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -58987,7 +58987,7 @@ stage: Added - name: Added5487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -58996,7 +58996,7 @@ stage: Added - name: Modified5488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59004,7 +59004,7 @@ stage: Modified - name: Added5489 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59012,7 +59012,7 @@ stage: Added - name: Added5490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59021,7 +59021,7 @@ stage: Added - name: Modified5491 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59029,7 +59029,7 @@ stage: Modified - name: Added5492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59037,7 +59037,7 @@ stage: Added - name: Added5493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59046,7 +59046,7 @@ stage: Added - name: Modified5494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59054,7 +59054,7 @@ stage: Modified - name: Added5495 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59062,7 +59062,7 @@ stage: Added - name: Added5496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59071,7 +59071,7 @@ stage: Added - name: Modified5497 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59079,7 +59079,7 @@ stage: Modified - name: Added5498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59087,7 +59087,7 @@ stage: Added - name: Added5499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59096,7 +59096,7 @@ stage: Added - name: Modified5500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59104,7 +59104,7 @@ stage: Modified - name: Added5501 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59112,7 +59112,7 @@ stage: Added - name: Added5502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59121,7 +59121,7 @@ stage: Added - name: Modified5503 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59129,7 +59129,7 @@ stage: Modified - name: Added5504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59137,7 +59137,7 @@ stage: Added - name: Added5505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59146,7 +59146,7 @@ stage: Added - name: Added5506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59154,7 +59154,7 @@ stage: Added - name: Added5507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59163,7 +59163,7 @@ stage: Added - name: Added5508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59171,7 +59171,7 @@ stage: Added - name: Added5509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59180,7 +59180,7 @@ stage: Added - name: Added5510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59188,7 +59188,7 @@ stage: Added - name: Added5511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59197,7 +59197,7 @@ stage: Added - name: Added5512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59205,7 +59205,7 @@ stage: Added - name: Added5513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59214,7 +59214,7 @@ stage: Added - name: Added5514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59222,7 +59222,7 @@ stage: Added - name: Added5515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59231,7 +59231,7 @@ stage: Added - name: Added5516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59239,7 +59239,7 @@ stage: Added - name: Added5517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59248,7 +59248,7 @@ stage: Added - name: Added5518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -59256,7 +59256,7 @@ stage: Added - name: Added5519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59265,7 +59265,7 @@ stage: Added - name: Added5520 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59281,7 +59281,7 @@ stage: Added - name: Added5521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59290,7 +59290,7 @@ stage: Added - name: Modified5522 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59310,7 +59310,7 @@ stage: Modified - name: Added5523 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59326,7 +59326,7 @@ stage: Added - name: Added5524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59335,7 +59335,7 @@ stage: Added - name: Modified5525 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59355,7 +59355,7 @@ stage: Modified - name: Added5526 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59371,7 +59371,7 @@ stage: Added - name: Added5527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59380,7 +59380,7 @@ stage: Added - name: Modified5528 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59400,7 +59400,7 @@ stage: Modified - name: Added5529 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59416,7 +59416,7 @@ stage: Added - name: Added5530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59425,7 +59425,7 @@ stage: Added - name: Modified5531 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59445,7 +59445,7 @@ stage: Modified - name: Added5532 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59461,7 +59461,7 @@ stage: Added - name: Added5533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59470,7 +59470,7 @@ stage: Added - name: Modified5534 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59490,7 +59490,7 @@ stage: Modified - name: Added5535 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59506,7 +59506,7 @@ stage: Added - name: Added5536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59515,7 +59515,7 @@ stage: Added - name: Modified5537 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59535,7 +59535,7 @@ stage: Modified - name: Added5538 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59551,7 +59551,7 @@ stage: Added - name: Added5539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59560,7 +59560,7 @@ stage: Added - name: Modified5540 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59580,7 +59580,7 @@ stage: Modified - name: Added5541 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59596,7 +59596,7 @@ stage: Added - name: Added5542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59605,7 +59605,7 @@ stage: Added - name: Modified5543 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59625,7 +59625,7 @@ stage: Modified - name: Added5544 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2216\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59640,7 +59640,7 @@ stage: Added - name: Added5545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2216\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2216\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59649,7 +59649,7 @@ stage: Added - name: Added5546 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2217\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59664,7 +59664,7 @@ stage: Added - name: Added5547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2217\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2217\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59673,7 +59673,7 @@ stage: Added - name: Added5548 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2218\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59688,7 +59688,7 @@ stage: Added - name: Added5549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2218\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2218\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59697,7 +59697,7 @@ stage: Added - name: Added5550 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2219\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59712,7 +59712,7 @@ stage: Added - name: Added5551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2219\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2219\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59721,7 +59721,7 @@ stage: Added - name: Added5552 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2220\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59736,7 +59736,7 @@ stage: Added - name: Added5553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2220\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2220\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59745,7 +59745,7 @@ stage: Added - name: Added5554 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2221\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59760,7 +59760,7 @@ stage: Added - name: Added5555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2221\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2221\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59769,7 +59769,7 @@ stage: Added - name: Added5556 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2222\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59784,7 +59784,7 @@ stage: Added - name: Added5557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2222\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2222\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59793,7 +59793,7 @@ stage: Added - name: Added5558 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2223\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -59808,7 +59808,7 @@ stage: Added - name: Added5559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2223\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2223\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59817,7 +59817,7 @@ stage: Added - name: Added5560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59825,7 +59825,7 @@ stage: Added - name: Added5561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59834,7 +59834,7 @@ stage: Added - name: Modified5562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59842,7 +59842,7 @@ stage: Modified - name: Added5563 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59850,7 +59850,7 @@ stage: Added - name: Added5564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59859,7 +59859,7 @@ stage: Added - name: Modified5565 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59867,7 +59867,7 @@ stage: Modified - name: Added5566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59875,7 +59875,7 @@ stage: Added - name: Added5567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59884,7 +59884,7 @@ stage: Added - name: Modified5568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59892,7 +59892,7 @@ stage: Modified - name: Added5569 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59900,7 +59900,7 @@ stage: Added - name: Added5570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -59909,7 +59909,7 @@ stage: Added - name: Modified5571 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59917,7 +59917,7 @@ stage: Modified - name: Added5572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59925,7 +59925,7 @@ stage: Added - name: Added5573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59934,7 +59934,7 @@ stage: Added - name: Modified5574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59942,7 +59942,7 @@ stage: Modified - name: Added5575 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59950,7 +59950,7 @@ stage: Added - name: Added5576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59959,7 +59959,7 @@ stage: Added - name: Modified5577 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59967,7 +59967,7 @@ stage: Modified - name: Added5578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59975,7 +59975,7 @@ stage: Added - name: Added5579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -59984,7 +59984,7 @@ stage: Added - name: Modified5580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -59992,7 +59992,7 @@ stage: Modified - name: Added5581 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -60000,7 +60000,7 @@ stage: Added - name: Added5582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60009,7 +60009,7 @@ stage: Added - name: Modified5583 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723056, @@ -60017,14 +60017,14 @@ stage: Modified - name: Added5584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60033,14 +60033,14 @@ stage: Added - name: Added5586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60049,14 +60049,14 @@ stage: Added - name: Added5588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60065,14 +60065,14 @@ stage: Added - name: Added5590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60081,14 +60081,14 @@ stage: Added - name: Added5592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60097,14 +60097,14 @@ stage: Added - name: Added5594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60113,14 +60113,14 @@ stage: Added - name: Added5596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60129,14 +60129,14 @@ stage: Added - name: Added5598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60145,7 +60145,7 @@ stage: Added - name: Added5600 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60161,7 +60161,7 @@ stage: Added - name: Added5601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60170,7 +60170,7 @@ stage: Added - name: Modified5602 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60190,7 +60190,7 @@ stage: Modified - name: Added5603 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60206,7 +60206,7 @@ stage: Added - name: Added5604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60215,7 +60215,7 @@ stage: Added - name: Modified5605 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60235,7 +60235,7 @@ stage: Modified - name: Added5606 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60251,7 +60251,7 @@ stage: Added - name: Added5607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60260,7 +60260,7 @@ stage: Added - name: Modified5608 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60280,7 +60280,7 @@ stage: Modified - name: Added5609 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60296,7 +60296,7 @@ stage: Added - name: Added5610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60305,7 +60305,7 @@ stage: Added - name: Modified5611 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60325,7 +60325,7 @@ stage: Modified - name: Added5612 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60341,7 +60341,7 @@ stage: Added - name: Added5613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60350,7 +60350,7 @@ stage: Added - name: Modified5614 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60370,7 +60370,7 @@ stage: Modified - name: Added5615 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60386,7 +60386,7 @@ stage: Added - name: Added5616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60395,7 +60395,7 @@ stage: Added - name: Modified5617 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60415,7 +60415,7 @@ stage: Modified - name: Added5618 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60431,7 +60431,7 @@ stage: Added - name: Added5619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60440,7 +60440,7 @@ stage: Added - name: Modified5620 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60460,7 +60460,7 @@ stage: Modified - name: Added5621 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60476,7 +60476,7 @@ stage: Added - name: Added5622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60485,7 +60485,7 @@ stage: Added - name: Modified5623 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60505,7 +60505,7 @@ stage: Modified - name: Added5624 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2248\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60521,7 +60521,7 @@ stage: Added - name: Added5625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2248\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2248\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60530,7 +60530,7 @@ stage: Added - name: Added5626 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2249\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60546,7 +60546,7 @@ stage: Added - name: Added5627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2249\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2249\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60555,7 +60555,7 @@ stage: Added - name: Added5628 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2250\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60571,7 +60571,7 @@ stage: Added - name: Added5629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2250\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2250\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60580,7 +60580,7 @@ stage: Added - name: Added5630 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2251\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60596,7 +60596,7 @@ stage: Added - name: Added5631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2251\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2251\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60605,7 +60605,7 @@ stage: Added - name: Added5632 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2252\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60621,7 +60621,7 @@ stage: Added - name: Added5633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2252\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2252\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60630,7 +60630,7 @@ stage: Added - name: Added5634 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2253\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60646,7 +60646,7 @@ stage: Added - name: Added5635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2253\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2253\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60655,7 +60655,7 @@ stage: Added - name: Added5636 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2254\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60671,7 +60671,7 @@ stage: Added - name: Added5637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2254\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2254\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60680,7 +60680,7 @@ stage: Added - name: Added5638 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2255\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -60696,7 +60696,7 @@ stage: Added - name: Added5639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2255\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2255\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60705,7 +60705,7 @@ stage: Added - name: Added5640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60713,7 +60713,7 @@ stage: Added - name: Added5641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60722,7 +60722,7 @@ stage: Added - name: Modified5642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60730,7 +60730,7 @@ stage: Modified - name: Added5643 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60738,7 +60738,7 @@ stage: Added - name: Added5644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60747,7 +60747,7 @@ stage: Added - name: Modified5645 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60755,7 +60755,7 @@ stage: Modified - name: Added5646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60763,7 +60763,7 @@ stage: Added - name: Added5647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60772,7 +60772,7 @@ stage: Added - name: Modified5648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60780,7 +60780,7 @@ stage: Modified - name: Added5649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60788,7 +60788,7 @@ stage: Added - name: Added5650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60797,7 +60797,7 @@ stage: Added - name: Modified5651 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60805,7 +60805,7 @@ stage: Modified - name: Added5652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60813,7 +60813,7 @@ stage: Added - name: Added5653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60822,7 +60822,7 @@ stage: Added - name: Modified5654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60830,7 +60830,7 @@ stage: Modified - name: Added5655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60838,7 +60838,7 @@ stage: Added - name: Added5656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60847,7 +60847,7 @@ stage: Added - name: Modified5657 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60855,7 +60855,7 @@ stage: Modified - name: Added5658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60863,7 +60863,7 @@ stage: Added - name: Added5659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60872,7 +60872,7 @@ stage: Added - name: Modified5660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60880,7 +60880,7 @@ stage: Modified - name: Added5661 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60888,7 +60888,7 @@ stage: Added - name: Added5662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60897,7 +60897,7 @@ stage: Added - name: Modified5663 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -60905,7 +60905,7 @@ stage: Modified - name: Added5664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2264\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2264\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -60913,7 +60913,7 @@ stage: Added - name: Added5665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2264\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2264\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60922,7 +60922,7 @@ stage: Added - name: Added5666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2265\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2265\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -60930,7 +60930,7 @@ stage: Added - name: Added5667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2265\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2265\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60939,7 +60939,7 @@ stage: Added - name: Added5668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2266\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2266\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -60947,7 +60947,7 @@ stage: Added - name: Added5669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2266\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2266\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60956,7 +60956,7 @@ stage: Added - name: Added5670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2267\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2267\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -60964,7 +60964,7 @@ stage: Added - name: Added5671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2267\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2267\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -60973,7 +60973,7 @@ stage: Added - name: Added5672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2268\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2268\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -60981,7 +60981,7 @@ stage: Added - name: Added5673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2268\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2268\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -60990,7 +60990,7 @@ stage: Added - name: Added5674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2269\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2269\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -60998,7 +60998,7 @@ stage: Added - name: Added5675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2269\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2269\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61007,7 +61007,7 @@ stage: Added - name: Added5676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2270\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2270\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -61015,7 +61015,7 @@ stage: Added - name: Added5677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2270\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2270\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61024,7 +61024,7 @@ stage: Added - name: Added5678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2271\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2271\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -61032,7 +61032,7 @@ stage: Added - name: Added5679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2271\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2271\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61041,7 +61041,7 @@ stage: Added - name: Added5680 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61056,7 +61056,7 @@ stage: Added - name: Added5681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61065,7 +61065,7 @@ stage: Added - name: Modified5682 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61084,7 +61084,7 @@ stage: Modified - name: Added5683 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61099,7 +61099,7 @@ stage: Added - name: Added5684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61108,7 +61108,7 @@ stage: Added - name: Modified5685 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61127,7 +61127,7 @@ stage: Modified - name: Added5686 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61142,7 +61142,7 @@ stage: Added - name: Added5687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61151,7 +61151,7 @@ stage: Added - name: Modified5688 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61170,7 +61170,7 @@ stage: Modified - name: Added5689 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61185,7 +61185,7 @@ stage: Added - name: Added5690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61194,7 +61194,7 @@ stage: Added - name: Modified5691 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61213,7 +61213,7 @@ stage: Modified - name: Added5692 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61228,7 +61228,7 @@ stage: Added - name: Added5693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61237,7 +61237,7 @@ stage: Added - name: Modified5694 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61256,7 +61256,7 @@ stage: Modified - name: Added5695 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61271,7 +61271,7 @@ stage: Added - name: Added5696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61280,7 +61280,7 @@ stage: Added - name: Modified5697 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61299,7 +61299,7 @@ stage: Modified - name: Added5698 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61314,7 +61314,7 @@ stage: Added - name: Added5699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61323,7 +61323,7 @@ stage: Added - name: Modified5700 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61342,7 +61342,7 @@ stage: Modified - name: Added5701 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61357,7 +61357,7 @@ stage: Added - name: Added5702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61366,7 +61366,7 @@ stage: Added - name: Modified5703 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61385,7 +61385,7 @@ stage: Modified - name: Added5704 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2280\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61400,7 +61400,7 @@ stage: Added - name: Added5705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2280\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2280\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61409,7 +61409,7 @@ stage: Added - name: Added5706 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2281\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61424,7 +61424,7 @@ stage: Added - name: Added5707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2281\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2281\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61433,7 +61433,7 @@ stage: Added - name: Added5708 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2282\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61448,7 +61448,7 @@ stage: Added - name: Added5709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2282\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2282\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61457,7 +61457,7 @@ stage: Added - name: Added5710 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2283\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61472,7 +61472,7 @@ stage: Added - name: Added5711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2283\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2283\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61481,7 +61481,7 @@ stage: Added - name: Added5712 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2284\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61496,7 +61496,7 @@ stage: Added - name: Added5713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2284\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2284\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61505,7 +61505,7 @@ stage: Added - name: Added5714 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2285\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61520,7 +61520,7 @@ stage: Added - name: Added5715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2285\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2285\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61529,7 +61529,7 @@ stage: Added - name: Added5716 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2286\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61544,7 +61544,7 @@ stage: Added - name: Added5717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2286\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2286\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61553,7 +61553,7 @@ stage: Added - name: Added5718 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2287\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61568,7 +61568,7 @@ stage: Added - name: Added5719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2287\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2287\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61577,14 +61577,14 @@ stage: Added - name: Added5720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Added - name: Added5721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61593,21 +61593,21 @@ stage: Added - name: Modified5722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Modified - name: Added5723 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Added - name: Added5724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61616,21 +61616,21 @@ stage: Added - name: Modified5725 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Modified - name: Added5726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Added - name: Added5727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61639,21 +61639,21 @@ stage: Added - name: Modified5728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Modified - name: Added5729 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Added - name: Added5730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61662,21 +61662,21 @@ stage: Added - name: Modified5731 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Modified - name: Added5732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Added - name: Added5733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61685,21 +61685,21 @@ stage: Added - name: Modified5734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Modified - name: Added5735 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Added - name: Added5736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61708,21 +61708,21 @@ stage: Added - name: Modified5737 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Modified - name: Added5738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Added - name: Added5739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61731,21 +61731,21 @@ stage: Added - name: Modified5740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Modified - name: Added5741 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Added - name: Added5742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61754,21 +61754,21 @@ stage: Added - name: Modified5743 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722884,"checksum":"046e6f1890df11b6641021ccbc97b7a8d8215884"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "mtime": 1606723056, "checksum": "642d233ae9698f821a7b1afee207c9abaca21320"}}' stage: Modified - name: Added5744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2296\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2296\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2296\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2296\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61777,14 +61777,14 @@ stage: Added - name: Added5746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2297\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2297\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2297\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2297\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61793,14 +61793,14 @@ stage: Added - name: Added5748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2298\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2298\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2298\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2298\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61809,14 +61809,14 @@ stage: Added - name: Added5750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2299\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2299\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2299\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2299\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61825,14 +61825,14 @@ stage: Added - name: Added5752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2300\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2300\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2300\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2300\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61841,14 +61841,14 @@ stage: Added - name: Added5754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2301\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2301\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2301\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2301\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61857,14 +61857,14 @@ stage: Added - name: Added5756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2302\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2302\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2302\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2302\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61873,14 +61873,14 @@ stage: Added - name: Added5758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2303\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2303\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added5759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2303\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2303\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -61889,7 +61889,7 @@ stage: Added - name: Added5760 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61905,7 +61905,7 @@ stage: Added - name: Added5761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61913,7 +61913,7 @@ stage: Added - name: Modified5762 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61933,7 +61933,7 @@ stage: Modified - name: Added5763 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61949,7 +61949,7 @@ stage: Added - name: Added5764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -61957,7 +61957,7 @@ stage: Added - name: Modified5765 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61977,7 +61977,7 @@ stage: Modified - name: Added5766 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -61993,7 +61993,7 @@ stage: Added - name: Added5767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62001,7 +62001,7 @@ stage: Added - name: Modified5768 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62021,7 +62021,7 @@ stage: Modified - name: Added5769 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62037,7 +62037,7 @@ stage: Added - name: Added5770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62045,7 +62045,7 @@ stage: Added - name: Modified5771 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62065,7 +62065,7 @@ stage: Modified - name: Added5772 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62081,7 +62081,7 @@ stage: Added - name: Added5773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62089,7 +62089,7 @@ stage: Added - name: Modified5774 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62109,7 +62109,7 @@ stage: Modified - name: Added5775 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62125,7 +62125,7 @@ stage: Added - name: Added5776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62133,7 +62133,7 @@ stage: Added - name: Modified5777 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62153,7 +62153,7 @@ stage: Modified - name: Added5778 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62169,7 +62169,7 @@ stage: Added - name: Added5779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62177,7 +62177,7 @@ stage: Added - name: Modified5780 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62197,7 +62197,7 @@ stage: Modified - name: Added5781 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62213,7 +62213,7 @@ stage: Added - name: Added5782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62221,7 +62221,7 @@ stage: Added - name: Modified5783 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62241,7 +62241,7 @@ stage: Modified - name: Added5784 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2312\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62257,7 +62257,7 @@ stage: Added - name: Added5785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2312\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2312\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62265,7 +62265,7 @@ stage: Added - name: Added5786 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2313\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62281,7 +62281,7 @@ stage: Added - name: Added5787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2313\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2313\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62289,7 +62289,7 @@ stage: Added - name: Added5788 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2314\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62305,7 +62305,7 @@ stage: Added - name: Added5789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2314\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2314\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62313,7 +62313,7 @@ stage: Added - name: Added5790 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2315\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62329,7 +62329,7 @@ stage: Added - name: Added5791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2315\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2315\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62337,7 +62337,7 @@ stage: Added - name: Added5792 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2316\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62353,7 +62353,7 @@ stage: Added - name: Added5793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2316\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2316\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62361,7 +62361,7 @@ stage: Added - name: Added5794 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2317\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62377,7 +62377,7 @@ stage: Added - name: Added5795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2317\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2317\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62385,7 +62385,7 @@ stage: Added - name: Added5796 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2318\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62401,7 +62401,7 @@ stage: Added - name: Added5797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2318\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2318\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62409,7 +62409,7 @@ stage: Added - name: Added5798 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2319\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62425,7 +62425,7 @@ stage: Added - name: Added5799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2319\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2319\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62433,7 +62433,7 @@ stage: Added - name: Added5800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62441,7 +62441,7 @@ stage: Added - name: Added5801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62449,7 +62449,7 @@ stage: Added - name: Modified5802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62457,7 +62457,7 @@ stage: Modified - name: Added5803 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62465,7 +62465,7 @@ stage: Added - name: Added5804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62473,7 +62473,7 @@ stage: Added - name: Modified5805 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62481,7 +62481,7 @@ stage: Modified - name: Added5806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62489,7 +62489,7 @@ stage: Added - name: Added5807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62497,7 +62497,7 @@ stage: Added - name: Modified5808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62505,7 +62505,7 @@ stage: Modified - name: Added5809 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62513,7 +62513,7 @@ stage: Added - name: Added5810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62521,7 +62521,7 @@ stage: Added - name: Modified5811 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62529,7 +62529,7 @@ stage: Modified - name: Added5812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62537,7 +62537,7 @@ stage: Added - name: Added5813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62545,7 +62545,7 @@ stage: Added - name: Modified5814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62553,7 +62553,7 @@ stage: Modified - name: Added5815 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62561,7 +62561,7 @@ stage: Added - name: Added5816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62569,7 +62569,7 @@ stage: Added - name: Modified5817 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62577,7 +62577,7 @@ stage: Modified - name: Added5818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62585,7 +62585,7 @@ stage: Added - name: Added5819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62593,7 +62593,7 @@ stage: Added - name: Modified5820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62601,7 +62601,7 @@ stage: Modified - name: Added5821 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62609,7 +62609,7 @@ stage: Added - name: Added5822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62617,7 +62617,7 @@ stage: Added - name: Modified5823 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"6da853c3f83283d17e6e8a94aad136484972b288"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62625,7 +62625,7 @@ stage: Modified - name: Added5824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62633,7 +62633,7 @@ stage: Added - name: Added5825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62641,7 +62641,7 @@ stage: Added - name: Added5826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62649,7 +62649,7 @@ stage: Added - name: Added5827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62657,7 +62657,7 @@ stage: Added - name: Added5828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62665,7 +62665,7 @@ stage: Added - name: Added5829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62673,7 +62673,7 @@ stage: Added - name: Added5830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62681,7 +62681,7 @@ stage: Added - name: Added5831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62689,7 +62689,7 @@ stage: Added - name: Added5832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62697,7 +62697,7 @@ stage: Added - name: Added5833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62705,7 +62705,7 @@ stage: Added - name: Added5834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62713,7 +62713,7 @@ stage: Added - name: Added5835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62721,7 +62721,7 @@ stage: Added - name: Added5836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62729,7 +62729,7 @@ stage: Added - name: Added5837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62737,7 +62737,7 @@ stage: Added - name: Added5838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -62745,7 +62745,7 @@ stage: Added - name: Added5839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62753,7 +62753,7 @@ stage: Added - name: Added5840 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62769,7 +62769,7 @@ stage: Added - name: Added5841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62777,7 +62777,7 @@ stage: Added - name: Modified5842 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62797,7 +62797,7 @@ stage: Modified - name: Added5843 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62813,7 +62813,7 @@ stage: Added - name: Added5844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62821,7 +62821,7 @@ stage: Added - name: Modified5845 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62841,7 +62841,7 @@ stage: Modified - name: Added5846 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62857,7 +62857,7 @@ stage: Added - name: Added5847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62865,7 +62865,7 @@ stage: Added - name: Modified5848 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62885,7 +62885,7 @@ stage: Modified - name: Added5849 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62901,7 +62901,7 @@ stage: Added - name: Added5850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62909,7 +62909,7 @@ stage: Added - name: Modified5851 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62929,7 +62929,7 @@ stage: Modified - name: Added5852 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62945,7 +62945,7 @@ stage: Added - name: Added5853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62953,7 +62953,7 @@ stage: Added - name: Modified5854 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62973,7 +62973,7 @@ stage: Modified - name: Added5855 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -62989,7 +62989,7 @@ stage: Added - name: Added5856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -62997,7 +62997,7 @@ stage: Added - name: Modified5857 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63017,7 +63017,7 @@ stage: Modified - name: Added5858 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63033,7 +63033,7 @@ stage: Added - name: Added5859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63041,7 +63041,7 @@ stage: Added - name: Modified5860 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63061,7 +63061,7 @@ stage: Modified - name: Added5861 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63077,7 +63077,7 @@ stage: Added - name: Added5862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63085,7 +63085,7 @@ stage: Added - name: Modified5863 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63105,7 +63105,7 @@ stage: Modified - name: Added5864 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2344\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63120,7 +63120,7 @@ stage: Added - name: Added5865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2344\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2344\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63128,7 +63128,7 @@ stage: Added - name: Added5866 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2345\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63143,7 +63143,7 @@ stage: Added - name: Added5867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2345\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2345\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63151,7 +63151,7 @@ stage: Added - name: Added5868 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2346\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63166,7 +63166,7 @@ stage: Added - name: Added5869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2346\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2346\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63174,7 +63174,7 @@ stage: Added - name: Added5870 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2347\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63189,7 +63189,7 @@ stage: Added - name: Added5871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2347\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2347\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63197,7 +63197,7 @@ stage: Added - name: Added5872 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2348\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63212,7 +63212,7 @@ stage: Added - name: Added5873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2348\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2348\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63220,7 +63220,7 @@ stage: Added - name: Added5874 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2349\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63235,7 +63235,7 @@ stage: Added - name: Added5875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2349\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2349\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63243,7 +63243,7 @@ stage: Added - name: Added5876 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2350\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63258,7 +63258,7 @@ stage: Added - name: Added5877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2350\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2350\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63266,7 +63266,7 @@ stage: Added - name: Added5878 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2351\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63281,7 +63281,7 @@ stage: Added - name: Added5879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2351\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2351\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63289,7 +63289,7 @@ stage: Added - name: Added5880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63297,7 +63297,7 @@ stage: Added - name: Added5881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63305,7 +63305,7 @@ stage: Added - name: Modified5882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63313,7 +63313,7 @@ stage: Modified - name: Added5883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63321,7 +63321,7 @@ stage: Added - name: Added5884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63329,7 +63329,7 @@ stage: Added - name: Modified5885 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63337,7 +63337,7 @@ stage: Modified - name: Added5886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63345,7 +63345,7 @@ stage: Added - name: Added5887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63353,7 +63353,7 @@ stage: Added - name: Modified5888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63361,7 +63361,7 @@ stage: Modified - name: Added5889 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63369,7 +63369,7 @@ stage: Added - name: Added5890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63377,7 +63377,7 @@ stage: Added - name: Modified5891 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63385,7 +63385,7 @@ stage: Modified - name: Added5892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63393,7 +63393,7 @@ stage: Added - name: Added5893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63401,7 +63401,7 @@ stage: Added - name: Modified5894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63409,7 +63409,7 @@ stage: Modified - name: Added5895 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769881,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key", "arch": "[x64]", "timestamp": 1606769881, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63417,7 +63417,7 @@ stage: Added - name: Added5896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769881,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769881, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63425,7 +63425,7 @@ stage: Added - name: Modified5897 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63433,7 +63433,7 @@ stage: Modified - name: Added5898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63441,7 +63441,7 @@ stage: Added - name: Added5899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63449,7 +63449,7 @@ stage: Added - name: Modified5900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63457,7 +63457,7 @@ stage: Modified - name: Added5901 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63465,7 +63465,7 @@ stage: Added - name: Added5902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63473,7 +63473,7 @@ stage: Added - name: Modified5903 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722884,"checksum":"7c8a9b17c8af3f1e5c14935a1067afe7462219de"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -63481,14 +63481,14 @@ stage: Modified - name: Added5904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63496,14 +63496,14 @@ stage: Added - name: Added5906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63511,14 +63511,14 @@ stage: Added - name: Added5908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63526,14 +63526,14 @@ stage: Added - name: Added5910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63541,14 +63541,14 @@ stage: Added - name: Added5912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63556,14 +63556,14 @@ stage: Added - name: Added5914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63571,14 +63571,14 @@ stage: Added - name: Added5916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63586,14 +63586,14 @@ stage: Added - name: Added5918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added5919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63601,7 +63601,7 @@ stage: Added - name: Added5920 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63617,7 +63617,7 @@ stage: Added - name: Added5921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63625,7 +63625,7 @@ stage: Added - name: Modified5922 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63645,7 +63645,7 @@ stage: Modified - name: Added5923 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63661,7 +63661,7 @@ stage: Added - name: Added5924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63669,7 +63669,7 @@ stage: Added - name: Modified5925 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63689,7 +63689,7 @@ stage: Modified - name: Added5926 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63705,7 +63705,7 @@ stage: Added - name: Added5927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63713,7 +63713,7 @@ stage: Added - name: Modified5928 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63733,7 +63733,7 @@ stage: Modified - name: Added5929 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63749,7 +63749,7 @@ stage: Added - name: Added5930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63757,7 +63757,7 @@ stage: Added - name: Modified5931 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63777,7 +63777,7 @@ stage: Modified - name: Added5932 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63793,7 +63793,7 @@ stage: Added - name: Added5933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63801,7 +63801,7 @@ stage: Added - name: Modified5934 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63821,7 +63821,7 @@ stage: Modified - name: Added5935 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63837,7 +63837,7 @@ stage: Added - name: Added5936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63845,7 +63845,7 @@ stage: Added - name: Modified5937 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63865,7 +63865,7 @@ stage: Modified - name: Added5938 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63881,7 +63881,7 @@ stage: Added - name: Added5939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63889,7 +63889,7 @@ stage: Added - name: Modified5940 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63909,7 +63909,7 @@ stage: Modified - name: Added5941 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63925,7 +63925,7 @@ stage: Added - name: Added5942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63933,7 +63933,7 @@ stage: Added - name: Modified5943 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63953,7 +63953,7 @@ stage: Modified - name: Added5944 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2376\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63969,7 +63969,7 @@ stage: Added - name: Added5945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2376\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2376\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -63977,7 +63977,7 @@ stage: Added - name: Added5946 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2377\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -63993,7 +63993,7 @@ stage: Added - name: Added5947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2377\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2377\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64001,7 +64001,7 @@ stage: Added - name: Added5948 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2378\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64017,7 +64017,7 @@ stage: Added - name: Added5949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2378\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2378\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64025,7 +64025,7 @@ stage: Added - name: Added5950 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2379\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64041,7 +64041,7 @@ stage: Added - name: Added5951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2379\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2379\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64049,7 +64049,7 @@ stage: Added - name: Added5952 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2380\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64065,7 +64065,7 @@ stage: Added - name: Added5953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2380\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2380\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64073,7 +64073,7 @@ stage: Added - name: Added5954 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2381\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64089,7 +64089,7 @@ stage: Added - name: Added5955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2381\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2381\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64097,7 +64097,7 @@ stage: Added - name: Added5956 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2382\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64113,7 +64113,7 @@ stage: Added - name: Added5957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2382\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2382\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64121,7 +64121,7 @@ stage: Added - name: Added5958 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2383\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64137,7 +64137,7 @@ stage: Added - name: Added5959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2383\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2383\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64145,7 +64145,7 @@ stage: Added - name: Added5960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64153,7 +64153,7 @@ stage: Added - name: Added5961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64161,7 +64161,7 @@ stage: Added - name: Modified5962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64169,7 +64169,7 @@ stage: Modified - name: Added5963 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64177,7 +64177,7 @@ stage: Added - name: Added5964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64185,7 +64185,7 @@ stage: Added - name: Modified5965 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64193,7 +64193,7 @@ stage: Modified - name: Added5966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64201,7 +64201,7 @@ stage: Added - name: Added5967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64209,7 +64209,7 @@ stage: Added - name: Modified5968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722884,"checksum":"404566a1b8588f297371a7ac35371f8bb1500ca7"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64217,7 +64217,7 @@ stage: Modified - name: Added5969 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64225,7 +64225,7 @@ stage: Added - name: Added5970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64233,7 +64233,7 @@ stage: Added - name: Modified5971 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64241,7 +64241,7 @@ stage: Modified - name: Added5972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64249,7 +64249,7 @@ stage: Added - name: Added5973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64257,7 +64257,7 @@ stage: Added - name: Modified5974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64265,7 +64265,7 @@ stage: Modified - name: Added5975 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64273,7 +64273,7 @@ stage: Added - name: Added5976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64281,7 +64281,7 @@ stage: Added - name: Modified5977 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64289,7 +64289,7 @@ stage: Modified - name: Added5978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64297,7 +64297,7 @@ stage: Added - name: Added5979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64305,7 +64305,7 @@ stage: Added - name: Modified5980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64313,7 +64313,7 @@ stage: Modified - name: Added5981 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64321,7 +64321,7 @@ stage: Added - name: Added5982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64329,7 +64329,7 @@ stage: Added - name: Modified5983 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -64337,7 +64337,7 @@ stage: Modified - name: Added5984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2392\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2392\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -64345,7 +64345,7 @@ stage: Added - name: Added5985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2392\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2392\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64353,7 +64353,7 @@ stage: Added - name: Added5986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2393\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2393\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -64361,7 +64361,7 @@ stage: Added - name: Added5987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2393\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2393\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64369,7 +64369,7 @@ stage: Added - name: Added5988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2394\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2394\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -64377,7 +64377,7 @@ stage: Added - name: Added5989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2394\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2394\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64385,7 +64385,7 @@ stage: Added - name: Added5990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2395\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2395\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -64393,7 +64393,7 @@ stage: Added - name: Added5991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2395\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2395\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64401,7 +64401,7 @@ stage: Added - name: Added5992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2396\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2396\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -64409,7 +64409,7 @@ stage: Added - name: Added5993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2396\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2396\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64417,7 +64417,7 @@ stage: Added - name: Added5994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2397\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2397\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -64425,7 +64425,7 @@ stage: Added - name: Added5995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2397\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2397\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64433,7 +64433,7 @@ stage: Added - name: Added5996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2398\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2398\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -64441,7 +64441,7 @@ stage: Added - name: Added5997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2398\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2398\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64449,7 +64449,7 @@ stage: Added - name: Added5998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2399\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2399\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -64457,7 +64457,7 @@ stage: Added - name: Added5999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2399\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2399\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64465,7 +64465,7 @@ stage: Added - name: Added6000 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64480,7 +64480,7 @@ stage: Added - name: Added6001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64488,7 +64488,7 @@ stage: Added - name: Modified6002 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64507,7 +64507,7 @@ stage: Modified - name: Added6003 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64522,7 +64522,7 @@ stage: Added - name: Added6004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64530,7 +64530,7 @@ stage: Added - name: Modified6005 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64549,7 +64549,7 @@ stage: Modified - name: Added6006 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64564,7 +64564,7 @@ stage: Added - name: Added6007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64572,7 +64572,7 @@ stage: Added - name: Modified6008 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64591,7 +64591,7 @@ stage: Modified - name: Added6009 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64606,7 +64606,7 @@ stage: Added - name: Added6010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64614,7 +64614,7 @@ stage: Added - name: Modified6011 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64633,7 +64633,7 @@ stage: Modified - name: Added6012 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64648,7 +64648,7 @@ stage: Added - name: Added6013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64656,7 +64656,7 @@ stage: Added - name: Modified6014 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64675,7 +64675,7 @@ stage: Modified - name: Added6015 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64690,7 +64690,7 @@ stage: Added - name: Added6016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64698,7 +64698,7 @@ stage: Added - name: Modified6017 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64717,7 +64717,7 @@ stage: Modified - name: Added6018 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64732,7 +64732,7 @@ stage: Added - name: Added6019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64740,7 +64740,7 @@ stage: Added - name: Modified6020 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64759,7 +64759,7 @@ stage: Modified - name: Added6021 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64774,7 +64774,7 @@ stage: Added - name: Added6022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64782,7 +64782,7 @@ stage: Added - name: Modified6023 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64801,7 +64801,7 @@ stage: Modified - name: Added6024 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2408\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64816,7 +64816,7 @@ stage: Added - name: Added6025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2408\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2408\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64824,7 +64824,7 @@ stage: Added - name: Added6026 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2409\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64839,7 +64839,7 @@ stage: Added - name: Added6027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2409\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2409\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64847,7 +64847,7 @@ stage: Added - name: Added6028 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2410\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64862,7 +64862,7 @@ stage: Added - name: Added6029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2410\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2410\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64870,7 +64870,7 @@ stage: Added - name: Added6030 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2411\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64885,7 +64885,7 @@ stage: Added - name: Added6031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2411\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2411\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64893,7 +64893,7 @@ stage: Added - name: Added6032 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2412\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64908,7 +64908,7 @@ stage: Added - name: Added6033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2412\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2412\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64916,7 +64916,7 @@ stage: Added - name: Added6034 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2413\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64931,7 +64931,7 @@ stage: Added - name: Added6035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2413\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2413\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64939,7 +64939,7 @@ stage: Added - name: Added6036 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2414\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64954,7 +64954,7 @@ stage: Added - name: Added6037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2414\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2414\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64962,7 +64962,7 @@ stage: Added - name: Added6038 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2415\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -64977,7 +64977,7 @@ stage: Added - name: Added6039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2415\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2415\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -64985,14 +64985,14 @@ stage: Added - name: Added6040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Added - name: Added6041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65000,21 +65000,21 @@ stage: Added - name: Modified6042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Modified - name: Added6043 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Added - name: Added6044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65022,21 +65022,21 @@ stage: Added - name: Modified6045 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Modified - name: Added6046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Added - name: Added6047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65044,21 +65044,21 @@ stage: Added - name: Modified6048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Modified - name: Added6049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Added - name: Added6050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65066,21 +65066,21 @@ stage: Added - name: Modified6051 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Modified - name: Added6052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Added - name: Added6053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65088,21 +65088,21 @@ stage: Added - name: Modified6054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Modified - name: Added6055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Added - name: Added6056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65110,21 +65110,21 @@ stage: Added - name: Modified6057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Modified - name: Added6058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Added - name: Added6059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65132,21 +65132,21 @@ stage: Added - name: Modified6060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Modified - name: Added6061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Added - name: Added6062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65154,21 +65154,21 @@ stage: Added - name: Modified6063 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "mtime": 1606723057, "checksum": "551ed7b7e8e4a448f1e269d0813358604c044ab8"}}' stage: Modified - name: Added6064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2424\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2424\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2424\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2424\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65176,14 +65176,14 @@ stage: Added - name: Added6066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2425\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2425\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2425\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2425\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65191,14 +65191,14 @@ stage: Added - name: Added6068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2426\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2426\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2426\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2426\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65206,14 +65206,14 @@ stage: Added - name: Added6070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2427\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2427\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2427\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2427\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65221,14 +65221,14 @@ stage: Added - name: Added6072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2428\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2428\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2428\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2428\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65236,14 +65236,14 @@ stage: Added - name: Added6074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2429\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2429\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2429\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2429\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65251,14 +65251,14 @@ stage: Added - name: Added6076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2430\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2430\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2430\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2430\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65266,14 +65266,14 @@ stage: Added - name: Added6078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2431\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2431\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2431\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2431\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65281,7 +65281,7 @@ stage: Added - name: Added6080 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65297,7 +65297,7 @@ stage: Added - name: Added6081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65305,7 +65305,7 @@ stage: Added - name: Modified6082 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65325,7 +65325,7 @@ stage: Modified - name: Added6083 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65341,7 +65341,7 @@ stage: Added - name: Added6084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65349,7 +65349,7 @@ stage: Added - name: Modified6085 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65369,7 +65369,7 @@ stage: Modified - name: Added6086 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65385,7 +65385,7 @@ stage: Added - name: Added6087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65393,7 +65393,7 @@ stage: Added - name: Modified6088 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65413,7 +65413,7 @@ stage: Modified - name: Added6089 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65429,7 +65429,7 @@ stage: Added - name: Added6090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65437,7 +65437,7 @@ stage: Added - name: Modified6091 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65457,7 +65457,7 @@ stage: Modified - name: Added6092 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65473,7 +65473,7 @@ stage: Added - name: Added6093 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -65481,7 +65481,7 @@ stage: Added - name: Modified6094 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65501,7 +65501,7 @@ stage: Modified - name: Added6095 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65517,7 +65517,7 @@ stage: Added - name: Added6096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -65525,7 +65525,7 @@ stage: Added - name: Modified6097 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65545,7 +65545,7 @@ stage: Modified - name: Added6098 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65561,7 +65561,7 @@ stage: Added - name: Added6099 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -65569,7 +65569,7 @@ stage: Added - name: Modified6100 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65589,7 +65589,7 @@ stage: Modified - name: Added6101 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65605,7 +65605,7 @@ stage: Added - name: Added6102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -65613,7 +65613,7 @@ stage: Added - name: Modified6103 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65633,7 +65633,7 @@ stage: Modified - name: Added6104 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2440\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65649,7 +65649,7 @@ stage: Added - name: Added6105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2440\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2440\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65657,7 +65657,7 @@ stage: Added - name: Added6106 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2441\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65673,7 +65673,7 @@ stage: Added - name: Added6107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2441\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2441\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65681,7 +65681,7 @@ stage: Added - name: Added6108 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2442\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65697,7 +65697,7 @@ stage: Added - name: Added6109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2442\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2442\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65705,7 +65705,7 @@ stage: Added - name: Added6110 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2443\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65721,7 +65721,7 @@ stage: Added - name: Added6111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2443\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2443\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65729,7 +65729,7 @@ stage: Added - name: Added6112 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2444\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65745,7 +65745,7 @@ stage: Added - name: Added6113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2444\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2444\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -65753,7 +65753,7 @@ stage: Added - name: Added6114 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2445\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65769,7 +65769,7 @@ stage: Added - name: Added6115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2445\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2445\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -65777,7 +65777,7 @@ stage: Added - name: Added6116 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2446\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65793,7 +65793,7 @@ stage: Added - name: Added6117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2446\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2446\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -65801,7 +65801,7 @@ stage: Added - name: Added6118 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2447\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -65817,7 +65817,7 @@ stage: Added - name: Added6119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2447\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2447\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -65825,7 +65825,7 @@ stage: Added - name: Added6120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65833,7 +65833,7 @@ stage: Added - name: Added6121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65841,7 +65841,7 @@ stage: Added - name: Modified6122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65849,7 +65849,7 @@ stage: Modified - name: Added6123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65857,7 +65857,7 @@ stage: Added - name: Added6124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65865,7 +65865,7 @@ stage: Added - name: Modified6125 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65873,7 +65873,7 @@ stage: Modified - name: Added6126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65881,7 +65881,7 @@ stage: Added - name: Added6127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65889,7 +65889,7 @@ stage: Added - name: Modified6128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65897,7 +65897,7 @@ stage: Modified - name: Added6129 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65905,7 +65905,7 @@ stage: Added - name: Added6130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -65913,7 +65913,7 @@ stage: Added - name: Modified6131 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65921,7 +65921,7 @@ stage: Modified - name: Added6132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65929,7 +65929,7 @@ stage: Added - name: Added6133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -65937,7 +65937,7 @@ stage: Added - name: Modified6134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65945,7 +65945,7 @@ stage: Modified - name: Added6135 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65953,7 +65953,7 @@ stage: Added - name: Added6136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -65961,7 +65961,7 @@ stage: Added - name: Modified6137 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65969,7 +65969,7 @@ stage: Modified - name: Added6138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65977,7 +65977,7 @@ stage: Added - name: Added6139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -65985,7 +65985,7 @@ stage: Added - name: Modified6140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -65993,7 +65993,7 @@ stage: Modified - name: Added6141 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -66001,7 +66001,7 @@ stage: Added - name: Added6142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66009,7 +66009,7 @@ stage: Added - name: Modified6143 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -66017,7 +66017,7 @@ stage: Modified - name: Added6144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -66025,7 +66025,7 @@ stage: Added - name: Added6145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66033,7 +66033,7 @@ stage: Added - name: Added6146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -66041,7 +66041,7 @@ stage: Added - name: Added6147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66049,7 +66049,7 @@ stage: Added - name: Added6148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -66057,7 +66057,7 @@ stage: Added - name: Added6149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66065,7 +66065,7 @@ stage: Added - name: Added6150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -66073,7 +66073,7 @@ stage: Added - name: Added6151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66081,7 +66081,7 @@ stage: Added - name: Added6152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -66089,7 +66089,7 @@ stage: Added - name: Added6153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66097,7 +66097,7 @@ stage: Added - name: Added6154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -66105,7 +66105,7 @@ stage: Added - name: Added6155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66113,7 +66113,7 @@ stage: Added - name: Added6156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -66121,7 +66121,7 @@ stage: Added - name: Added6157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66129,7 +66129,7 @@ stage: Added - name: Added6158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -66137,7 +66137,7 @@ stage: Added - name: Added6159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66145,7 +66145,7 @@ stage: Added - name: Added6160 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66161,7 +66161,7 @@ stage: Added - name: Added6161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66169,7 +66169,7 @@ stage: Added - name: Modified6162 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66189,7 +66189,7 @@ stage: Modified - name: Added6163 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66205,7 +66205,7 @@ stage: Added - name: Added6164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66213,7 +66213,7 @@ stage: Added - name: Modified6165 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66233,7 +66233,7 @@ stage: Modified - name: Added6166 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66249,7 +66249,7 @@ stage: Added - name: Added6167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66257,7 +66257,7 @@ stage: Added - name: Modified6168 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66277,7 +66277,7 @@ stage: Modified - name: Added6169 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66293,7 +66293,7 @@ stage: Added - name: Added6170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66301,7 +66301,7 @@ stage: Added - name: Modified6171 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66321,7 +66321,7 @@ stage: Modified - name: Added6172 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66337,7 +66337,7 @@ stage: Added - name: Added6173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66345,7 +66345,7 @@ stage: Added - name: Modified6174 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66365,7 +66365,7 @@ stage: Modified - name: Added6175 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66381,7 +66381,7 @@ stage: Added - name: Added6176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66389,7 +66389,7 @@ stage: Added - name: Modified6177 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66409,7 +66409,7 @@ stage: Modified - name: Added6178 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66425,7 +66425,7 @@ stage: Added - name: Added6179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66433,7 +66433,7 @@ stage: Added - name: Modified6180 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66453,7 +66453,7 @@ stage: Modified - name: Added6181 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66469,7 +66469,7 @@ stage: Added - name: Added6182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66477,7 +66477,7 @@ stage: Added - name: Modified6183 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66497,7 +66497,7 @@ stage: Modified - name: Added6184 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2472\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66512,7 +66512,7 @@ stage: Added - name: Added6185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2472\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2472\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66520,7 +66520,7 @@ stage: Added - name: Added6186 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2473\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66535,7 +66535,7 @@ stage: Added - name: Added6187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2473\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2473\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66543,7 +66543,7 @@ stage: Added - name: Added6188 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2474\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66558,7 +66558,7 @@ stage: Added - name: Added6189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2474\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2474\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66566,7 +66566,7 @@ stage: Added - name: Added6190 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2475\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66581,7 +66581,7 @@ stage: Added - name: Added6191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2475\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2475\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66589,7 +66589,7 @@ stage: Added - name: Added6192 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2476\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66604,7 +66604,7 @@ stage: Added - name: Added6193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2476\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2476\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66612,7 +66612,7 @@ stage: Added - name: Added6194 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2477\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66627,7 +66627,7 @@ stage: Added - name: Added6195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2477\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2477\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66635,7 +66635,7 @@ stage: Added - name: Added6196 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2478\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66650,7 +66650,7 @@ stage: Added - name: Added6197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2478\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2478\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66658,7 +66658,7 @@ stage: Added - name: Added6198 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2479\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -66673,7 +66673,7 @@ stage: Added - name: Added6199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2479\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2479\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66681,7 +66681,7 @@ stage: Added - name: Added6200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66689,7 +66689,7 @@ stage: Added - name: Added6201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66697,7 +66697,7 @@ stage: Added - name: Modified6202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66705,7 +66705,7 @@ stage: Modified - name: Added6203 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66713,7 +66713,7 @@ stage: Added - name: Added6204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66721,7 +66721,7 @@ stage: Added - name: Modified6205 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66729,7 +66729,7 @@ stage: Modified - name: Added6206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66737,7 +66737,7 @@ stage: Added - name: Added6207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66745,7 +66745,7 @@ stage: Added - name: Modified6208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66753,7 +66753,7 @@ stage: Modified - name: Added6209 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66761,7 +66761,7 @@ stage: Added - name: Added6210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66769,7 +66769,7 @@ stage: Added - name: Modified6211 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66777,7 +66777,7 @@ stage: Modified - name: Added6212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66785,7 +66785,7 @@ stage: Added - name: Added6213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66793,7 +66793,7 @@ stage: Added - name: Modified6214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66801,7 +66801,7 @@ stage: Modified - name: Added6215 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66809,7 +66809,7 @@ stage: Added - name: Added6216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66817,7 +66817,7 @@ stage: Added - name: Modified6217 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66825,7 +66825,7 @@ stage: Modified - name: Added6218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66833,7 +66833,7 @@ stage: Added - name: Added6219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66841,7 +66841,7 @@ stage: Added - name: Modified6220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66849,7 +66849,7 @@ stage: Modified - name: Added6221 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66857,7 +66857,7 @@ stage: Added - name: Added6222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66865,7 +66865,7 @@ stage: Added - name: Modified6223 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723057, @@ -66873,14 +66873,14 @@ stage: Modified - name: Added6224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66888,14 +66888,14 @@ stage: Added - name: Added6226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66903,14 +66903,14 @@ stage: Added - name: Added6228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66918,14 +66918,14 @@ stage: Added - name: Added6230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -66933,14 +66933,14 @@ stage: Added - name: Added6232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66948,14 +66948,14 @@ stage: Added - name: Added6234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66963,14 +66963,14 @@ stage: Added - name: Added6236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66978,14 +66978,14 @@ stage: Added - name: Added6238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -66993,7 +66993,7 @@ stage: Added - name: Added6240 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67009,7 +67009,7 @@ stage: Added - name: Added6241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67017,7 +67017,7 @@ stage: Added - name: Modified6242 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67037,7 +67037,7 @@ stage: Modified - name: Added6243 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67053,7 +67053,7 @@ stage: Added - name: Added6244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67061,7 +67061,7 @@ stage: Added - name: Modified6245 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67081,7 +67081,7 @@ stage: Modified - name: Added6246 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67097,7 +67097,7 @@ stage: Added - name: Added6247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67105,7 +67105,7 @@ stage: Added - name: Modified6248 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67125,7 +67125,7 @@ stage: Modified - name: Added6249 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67141,7 +67141,7 @@ stage: Added - name: Added6250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67149,7 +67149,7 @@ stage: Added - name: Modified6251 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67169,7 +67169,7 @@ stage: Modified - name: Added6252 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67185,7 +67185,7 @@ stage: Added - name: Added6253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67193,7 +67193,7 @@ stage: Added - name: Modified6254 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67213,7 +67213,7 @@ stage: Modified - name: Added6255 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67229,7 +67229,7 @@ stage: Added - name: Added6256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67237,7 +67237,7 @@ stage: Added - name: Modified6257 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67257,7 +67257,7 @@ stage: Modified - name: Added6258 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67273,7 +67273,7 @@ stage: Added - name: Added6259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67281,7 +67281,7 @@ stage: Added - name: Modified6260 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67301,7 +67301,7 @@ stage: Modified - name: Added6261 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67317,7 +67317,7 @@ stage: Added - name: Added6262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67325,7 +67325,7 @@ stage: Added - name: Modified6263 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67345,7 +67345,7 @@ stage: Modified - name: Added6264 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2504\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67361,7 +67361,7 @@ stage: Added - name: Added6265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2504\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2504\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67369,7 +67369,7 @@ stage: Added - name: Added6266 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2505\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67385,7 +67385,7 @@ stage: Added - name: Added6267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2505\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2505\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67393,7 +67393,7 @@ stage: Added - name: Added6268 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2506\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67409,7 +67409,7 @@ stage: Added - name: Added6269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2506\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2506\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67417,7 +67417,7 @@ stage: Added - name: Added6270 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2507\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67433,7 +67433,7 @@ stage: Added - name: Added6271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2507\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2507\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67441,7 +67441,7 @@ stage: Added - name: Added6272 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2508\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67457,7 +67457,7 @@ stage: Added - name: Added6273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2508\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2508\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67465,7 +67465,7 @@ stage: Added - name: Added6274 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2509\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67481,7 +67481,7 @@ stage: Added - name: Added6275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2509\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2509\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67489,7 +67489,7 @@ stage: Added - name: Added6276 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2510\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67505,7 +67505,7 @@ stage: Added - name: Added6277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2510\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2510\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67513,7 +67513,7 @@ stage: Added - name: Added6278 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2511\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67529,7 +67529,7 @@ stage: Added - name: Added6279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2511\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2511\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67537,7 +67537,7 @@ stage: Added - name: Added6280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67545,7 +67545,7 @@ stage: Added - name: Added6281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67553,7 +67553,7 @@ stage: Added - name: Modified6282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67561,7 +67561,7 @@ stage: Modified - name: Added6283 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67569,7 +67569,7 @@ stage: Added - name: Added6284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67577,7 +67577,7 @@ stage: Added - name: Modified6285 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67585,7 +67585,7 @@ stage: Modified - name: Added6286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67593,7 +67593,7 @@ stage: Added - name: Added6287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67601,7 +67601,7 @@ stage: Added - name: Modified6288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67609,7 +67609,7 @@ stage: Modified - name: Added6289 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67617,7 +67617,7 @@ stage: Added - name: Added6290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67625,7 +67625,7 @@ stage: Added - name: Modified6291 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67633,7 +67633,7 @@ stage: Modified - name: Added6292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67641,7 +67641,7 @@ stage: Added - name: Added6293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67649,7 +67649,7 @@ stage: Added - name: Modified6294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67657,7 +67657,7 @@ stage: Modified - name: Added6295 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67665,7 +67665,7 @@ stage: Added - name: Added6296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67673,7 +67673,7 @@ stage: Added - name: Modified6297 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67681,7 +67681,7 @@ stage: Modified - name: Added6298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67689,7 +67689,7 @@ stage: Added - name: Added6299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67697,7 +67697,7 @@ stage: Added - name: Modified6300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67705,7 +67705,7 @@ stage: Modified - name: Added6301 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67713,7 +67713,7 @@ stage: Added - name: Added6302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67721,7 +67721,7 @@ stage: Added - name: Modified6303 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -67729,7 +67729,7 @@ stage: Modified - name: Added6304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2520\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2520\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -67737,7 +67737,7 @@ stage: Added - name: Added6305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2520\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2520\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67745,7 +67745,7 @@ stage: Added - name: Added6306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2521\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769882,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2521\\reg_key", "arch": "[x64]", "timestamp": 1606769882, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -67753,7 +67753,7 @@ stage: Added - name: Added6307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2521\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2521\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67761,7 +67761,7 @@ stage: Added - name: Added6308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2522\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2522\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -67769,7 +67769,7 @@ stage: Added - name: Added6309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2522\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2522\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67777,7 +67777,7 @@ stage: Added - name: Added6310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2523\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2523\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -67785,7 +67785,7 @@ stage: Added - name: Added6311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2523\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2523\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67793,7 +67793,7 @@ stage: Added - name: Added6312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2524\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2524\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -67801,7 +67801,7 @@ stage: Added - name: Added6313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2524\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2524\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67809,7 +67809,7 @@ stage: Added - name: Added6314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2525\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2525\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -67817,7 +67817,7 @@ stage: Added - name: Added6315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2525\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2525\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67825,7 +67825,7 @@ stage: Added - name: Added6316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2526\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2526\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -67833,7 +67833,7 @@ stage: Added - name: Added6317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2526\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2526\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67841,7 +67841,7 @@ stage: Added - name: Added6318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2527\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2527\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -67849,7 +67849,7 @@ stage: Added - name: Added6319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2527\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2527\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -67857,7 +67857,7 @@ stage: Added - name: Added6320 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67872,7 +67872,7 @@ stage: Added - name: Added6321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67880,7 +67880,7 @@ stage: Added - name: Modified6322 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67899,7 +67899,7 @@ stage: Modified - name: Added6323 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67914,7 +67914,7 @@ stage: Added - name: Added6324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67922,7 +67922,7 @@ stage: Added - name: Modified6325 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67941,7 +67941,7 @@ stage: Modified - name: Added6326 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67956,7 +67956,7 @@ stage: Added - name: Added6327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -67964,7 +67964,7 @@ stage: Added - name: Modified6328 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67983,7 +67983,7 @@ stage: Modified - name: Added6329 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -67998,7 +67998,7 @@ stage: Added - name: Added6330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68006,7 +68006,7 @@ stage: Added - name: Modified6331 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68025,7 +68025,7 @@ stage: Modified - name: Added6332 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68040,7 +68040,7 @@ stage: Added - name: Added6333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68048,7 +68048,7 @@ stage: Added - name: Modified6334 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68067,7 +68067,7 @@ stage: Modified - name: Added6335 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68082,7 +68082,7 @@ stage: Added - name: Added6336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68090,7 +68090,7 @@ stage: Added - name: Modified6337 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68109,7 +68109,7 @@ stage: Modified - name: Added6338 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68124,7 +68124,7 @@ stage: Added - name: Added6339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68132,7 +68132,7 @@ stage: Added - name: Modified6340 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68151,7 +68151,7 @@ stage: Modified - name: Added6341 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68166,7 +68166,7 @@ stage: Added - name: Added6342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68174,7 +68174,7 @@ stage: Added - name: Modified6343 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68193,7 +68193,7 @@ stage: Modified - name: Added6344 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2536\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68208,7 +68208,7 @@ stage: Added - name: Added6345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2536\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2536\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68216,7 +68216,7 @@ stage: Added - name: Added6346 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2537\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68231,7 +68231,7 @@ stage: Added - name: Added6347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2537\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2537\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68239,7 +68239,7 @@ stage: Added - name: Added6348 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2538\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68254,7 +68254,7 @@ stage: Added - name: Added6349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2538\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2538\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68262,7 +68262,7 @@ stage: Added - name: Added6350 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2539\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68277,7 +68277,7 @@ stage: Added - name: Added6351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2539\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2539\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68285,7 +68285,7 @@ stage: Added - name: Added6352 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2540\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68300,7 +68300,7 @@ stage: Added - name: Added6353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2540\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2540\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68308,7 +68308,7 @@ stage: Added - name: Added6354 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2541\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68323,7 +68323,7 @@ stage: Added - name: Added6355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2541\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2541\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68331,7 +68331,7 @@ stage: Added - name: Added6356 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2542\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68346,7 +68346,7 @@ stage: Added - name: Added6357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2542\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2542\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68354,7 +68354,7 @@ stage: Added - name: Added6358 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2543\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68369,7 +68369,7 @@ stage: Added - name: Added6359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2543\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2543\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68377,14 +68377,14 @@ stage: Added - name: Added6360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68392,21 +68392,21 @@ stage: Added - name: Modified6362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6363 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68414,21 +68414,21 @@ stage: Added - name: Modified6365 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68436,21 +68436,21 @@ stage: Added - name: Modified6368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6369 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68458,21 +68458,21 @@ stage: Added - name: Modified6371 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68480,21 +68480,21 @@ stage: Added - name: Modified6374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6375 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68502,21 +68502,21 @@ stage: Added - name: Modified6377 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68524,21 +68524,21 @@ stage: Added - name: Modified6380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6381 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68546,21 +68546,21 @@ stage: Added - name: Modified6383 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2552\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2552\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2552\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2552\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68568,14 +68568,14 @@ stage: Added - name: Added6386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2553\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2553\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2553\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2553\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68583,14 +68583,14 @@ stage: Added - name: Added6388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2554\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2554\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2554\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2554\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68598,14 +68598,14 @@ stage: Added - name: Added6390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2555\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2555\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2555\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2555\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -68613,14 +68613,14 @@ stage: Added - name: Added6392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2556\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2556\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2556\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2556\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68628,14 +68628,14 @@ stage: Added - name: Added6394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2557\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2557\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2557\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2557\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68643,14 +68643,14 @@ stage: Added - name: Added6396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2558\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2558\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2558\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2558\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68658,14 +68658,14 @@ stage: Added - name: Added6398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2559\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2559\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2559\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2559\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha1": @@ -68673,7 +68673,7 @@ stage: Added - name: Added6400 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68689,7 +68689,7 @@ stage: Added - name: Added6401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -68698,7 +68698,7 @@ stage: Added - name: Modified6402 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68718,7 +68718,7 @@ stage: Modified - name: Added6403 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68734,7 +68734,7 @@ stage: Added - name: Added6404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -68743,7 +68743,7 @@ stage: Added - name: Modified6405 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68763,7 +68763,7 @@ stage: Modified - name: Added6406 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68779,7 +68779,7 @@ stage: Added - name: Added6407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -68788,7 +68788,7 @@ stage: Added - name: Modified6408 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68808,7 +68808,7 @@ stage: Modified - name: Added6409 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68824,7 +68824,7 @@ stage: Added - name: Added6410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -68833,7 +68833,7 @@ stage: Added - name: Modified6411 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68853,7 +68853,7 @@ stage: Modified - name: Added6412 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68869,7 +68869,7 @@ stage: Added - name: Added6413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -68878,7 +68878,7 @@ stage: Added - name: Modified6414 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68898,7 +68898,7 @@ stage: Modified - name: Added6415 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68914,7 +68914,7 @@ stage: Added - name: Added6416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -68923,7 +68923,7 @@ stage: Added - name: Modified6417 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68943,7 +68943,7 @@ stage: Modified - name: Added6418 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68959,7 +68959,7 @@ stage: Added - name: Added6419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -68968,7 +68968,7 @@ stage: Added - name: Modified6420 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -68988,7 +68988,7 @@ stage: Modified - name: Added6421 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69004,7 +69004,7 @@ stage: Added - name: Added6422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69013,7 +69013,7 @@ stage: Added - name: Modified6423 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69033,7 +69033,7 @@ stage: Modified - name: Added6424 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2568\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69049,7 +69049,7 @@ stage: Added - name: Added6425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2568\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2568\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69058,7 +69058,7 @@ stage: Added - name: Added6426 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2569\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69074,7 +69074,7 @@ stage: Added - name: Added6427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2569\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2569\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69083,7 +69083,7 @@ stage: Added - name: Added6428 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2570\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69099,7 +69099,7 @@ stage: Added - name: Added6429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2570\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2570\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69108,7 +69108,7 @@ stage: Added - name: Added6430 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2571\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69124,7 +69124,7 @@ stage: Added - name: Added6431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2571\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2571\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69133,7 +69133,7 @@ stage: Added - name: Added6432 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2572\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69149,7 +69149,7 @@ stage: Added - name: Added6433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2572\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2572\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69158,7 +69158,7 @@ stage: Added - name: Added6434 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2573\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69174,7 +69174,7 @@ stage: Added - name: Added6435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2573\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2573\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69183,7 +69183,7 @@ stage: Added - name: Added6436 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2574\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69199,7 +69199,7 @@ stage: Added - name: Added6437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2574\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2574\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69208,7 +69208,7 @@ stage: Added - name: Added6438 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2575\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69224,7 +69224,7 @@ stage: Added - name: Added6439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2575\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2575\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69233,7 +69233,7 @@ stage: Added - name: Added6440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69241,7 +69241,7 @@ stage: Added - name: Added6441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69250,7 +69250,7 @@ stage: Added - name: Modified6442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69258,7 +69258,7 @@ stage: Modified - name: Added6443 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69266,7 +69266,7 @@ stage: Added - name: Added6444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69275,7 +69275,7 @@ stage: Added - name: Modified6445 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69283,7 +69283,7 @@ stage: Modified - name: Added6446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69291,7 +69291,7 @@ stage: Added - name: Added6447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69300,7 +69300,7 @@ stage: Added - name: Modified6448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69308,7 +69308,7 @@ stage: Modified - name: Added6449 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69316,7 +69316,7 @@ stage: Added - name: Added6450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69325,7 +69325,7 @@ stage: Added - name: Modified6451 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69333,7 +69333,7 @@ stage: Modified - name: Added6452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69341,7 +69341,7 @@ stage: Added - name: Added6453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69350,7 +69350,7 @@ stage: Added - name: Modified6454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69358,7 +69358,7 @@ stage: Modified - name: Added6455 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69366,7 +69366,7 @@ stage: Added - name: Added6456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69375,7 +69375,7 @@ stage: Added - name: Modified6457 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69383,7 +69383,7 @@ stage: Modified - name: Added6458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69391,7 +69391,7 @@ stage: Added - name: Added6459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69400,7 +69400,7 @@ stage: Added - name: Modified6460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69408,7 +69408,7 @@ stage: Modified - name: Added6461 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69416,7 +69416,7 @@ stage: Added - name: Added6462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69425,7 +69425,7 @@ stage: Added - name: Modified6463 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69433,7 +69433,7 @@ stage: Modified - name: Added6464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69441,7 +69441,7 @@ stage: Added - name: Added6465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69450,7 +69450,7 @@ stage: Added - name: Added6466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69458,7 +69458,7 @@ stage: Added - name: Added6467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69467,7 +69467,7 @@ stage: Added - name: Added6468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69475,7 +69475,7 @@ stage: Added - name: Added6469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69484,7 +69484,7 @@ stage: Added - name: Added6470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69492,7 +69492,7 @@ stage: Added - name: Added6471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69501,7 +69501,7 @@ stage: Added - name: Added6472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69509,7 +69509,7 @@ stage: Added - name: Added6473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69518,7 +69518,7 @@ stage: Added - name: Added6474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69526,7 +69526,7 @@ stage: Added - name: Added6475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69535,7 +69535,7 @@ stage: Added - name: Added6476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69543,7 +69543,7 @@ stage: Added - name: Added6477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69552,7 +69552,7 @@ stage: Added - name: Added6478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -69560,7 +69560,7 @@ stage: Added - name: Added6479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69569,7 +69569,7 @@ stage: Added - name: Added6480 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69585,7 +69585,7 @@ stage: Added - name: Added6481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69594,7 +69594,7 @@ stage: Added - name: Modified6482 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69614,7 +69614,7 @@ stage: Modified - name: Added6483 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69630,7 +69630,7 @@ stage: Added - name: Added6484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69639,7 +69639,7 @@ stage: Added - name: Modified6485 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69659,7 +69659,7 @@ stage: Modified - name: Added6486 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69675,7 +69675,7 @@ stage: Added - name: Added6487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69684,7 +69684,7 @@ stage: Added - name: Modified6488 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69704,7 +69704,7 @@ stage: Modified - name: Added6489 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69720,7 +69720,7 @@ stage: Added - name: Added6490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69729,7 +69729,7 @@ stage: Added - name: Modified6491 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69749,7 +69749,7 @@ stage: Modified - name: Added6492 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69765,7 +69765,7 @@ stage: Added - name: Added6493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69774,7 +69774,7 @@ stage: Added - name: Modified6494 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69794,7 +69794,7 @@ stage: Modified - name: Added6495 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69810,7 +69810,7 @@ stage: Added - name: Added6496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69819,7 +69819,7 @@ stage: Added - name: Modified6497 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69839,7 +69839,7 @@ stage: Modified - name: Added6498 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69855,7 +69855,7 @@ stage: Added - name: Added6499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69864,7 +69864,7 @@ stage: Added - name: Modified6500 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69884,7 +69884,7 @@ stage: Modified - name: Added6501 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69900,7 +69900,7 @@ stage: Added - name: Added6502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69909,7 +69909,7 @@ stage: Added - name: Modified6503 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69929,7 +69929,7 @@ stage: Modified - name: Added6504 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2600\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69944,7 +69944,7 @@ stage: Added - name: Added6505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2600\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2600\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69953,7 +69953,7 @@ stage: Added - name: Added6506 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2601\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69968,7 +69968,7 @@ stage: Added - name: Added6507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2601\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2601\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -69977,7 +69977,7 @@ stage: Added - name: Added6508 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2602\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -69992,7 +69992,7 @@ stage: Added - name: Added6509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2602\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2602\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70001,7 +70001,7 @@ stage: Added - name: Added6510 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2603\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70016,7 +70016,7 @@ stage: Added - name: Added6511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2603\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2603\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70025,7 +70025,7 @@ stage: Added - name: Added6512 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2604\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70040,7 +70040,7 @@ stage: Added - name: Added6513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2604\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2604\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70049,7 +70049,7 @@ stage: Added - name: Added6514 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2605\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70064,7 +70064,7 @@ stage: Added - name: Added6515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2605\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2605\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70073,7 +70073,7 @@ stage: Added - name: Added6516 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2606\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70088,7 +70088,7 @@ stage: Added - name: Added6517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2606\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2606\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70097,7 +70097,7 @@ stage: Added - name: Added6518 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2607\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70112,7 +70112,7 @@ stage: Added - name: Added6519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2607\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2607\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70121,7 +70121,7 @@ stage: Added - name: Added6520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70129,7 +70129,7 @@ stage: Added - name: Added6521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70138,7 +70138,7 @@ stage: Added - name: Modified6522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70146,7 +70146,7 @@ stage: Modified - name: Added6523 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70154,7 +70154,7 @@ stage: Added - name: Added6524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70163,7 +70163,7 @@ stage: Added - name: Modified6525 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70171,7 +70171,7 @@ stage: Modified - name: Added6526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70179,7 +70179,7 @@ stage: Added - name: Added6527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70188,7 +70188,7 @@ stage: Added - name: Modified6528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70196,7 +70196,7 @@ stage: Modified - name: Added6529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70204,7 +70204,7 @@ stage: Added - name: Added6530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70213,7 +70213,7 @@ stage: Added - name: Modified6531 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70221,7 +70221,7 @@ stage: Modified - name: Added6532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70229,7 +70229,7 @@ stage: Added - name: Added6533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70238,7 +70238,7 @@ stage: Added - name: Modified6534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70246,7 +70246,7 @@ stage: Modified - name: Added6535 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70254,7 +70254,7 @@ stage: Added - name: Added6536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70263,7 +70263,7 @@ stage: Added - name: Modified6537 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70271,7 +70271,7 @@ stage: Modified - name: Added6538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70279,7 +70279,7 @@ stage: Added - name: Added6539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70288,7 +70288,7 @@ stage: Added - name: Modified6540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70296,7 +70296,7 @@ stage: Modified - name: Added6541 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70304,7 +70304,7 @@ stage: Added - name: Added6542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70313,7 +70313,7 @@ stage: Added - name: Modified6543 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723058, @@ -70321,14 +70321,14 @@ stage: Modified - name: Added6544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70337,14 +70337,14 @@ stage: Added - name: Added6546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70353,14 +70353,14 @@ stage: Added - name: Added6548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70369,14 +70369,14 @@ stage: Added - name: Added6550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70385,14 +70385,14 @@ stage: Added - name: Added6552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70401,14 +70401,14 @@ stage: Added - name: Added6554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70417,14 +70417,14 @@ stage: Added - name: Added6556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70433,14 +70433,14 @@ stage: Added - name: Added6558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70449,7 +70449,7 @@ stage: Added - name: Added6560 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70465,7 +70465,7 @@ stage: Added - name: Added6561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70474,7 +70474,7 @@ stage: Added - name: Modified6562 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70494,7 +70494,7 @@ stage: Modified - name: Added6563 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70510,7 +70510,7 @@ stage: Added - name: Added6564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70519,7 +70519,7 @@ stage: Added - name: Modified6565 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70539,7 +70539,7 @@ stage: Modified - name: Added6566 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70555,7 +70555,7 @@ stage: Added - name: Added6567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70564,7 +70564,7 @@ stage: Added - name: Modified6568 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70584,7 +70584,7 @@ stage: Modified - name: Added6569 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70600,7 +70600,7 @@ stage: Added - name: Added6570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70609,7 +70609,7 @@ stage: Added - name: Modified6571 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70629,7 +70629,7 @@ stage: Modified - name: Added6572 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70645,7 +70645,7 @@ stage: Added - name: Added6573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70654,7 +70654,7 @@ stage: Added - name: Modified6574 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70674,7 +70674,7 @@ stage: Modified - name: Added6575 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70690,7 +70690,7 @@ stage: Added - name: Added6576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70699,7 +70699,7 @@ stage: Added - name: Modified6577 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70719,7 +70719,7 @@ stage: Modified - name: Added6578 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70735,7 +70735,7 @@ stage: Added - name: Added6579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70744,7 +70744,7 @@ stage: Added - name: Modified6580 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70764,7 +70764,7 @@ stage: Modified - name: Added6581 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70780,7 +70780,7 @@ stage: Added - name: Added6582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70789,7 +70789,7 @@ stage: Added - name: Modified6583 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70809,7 +70809,7 @@ stage: Modified - name: Added6584 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2632\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70825,7 +70825,7 @@ stage: Added - name: Added6585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2632\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2632\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70834,7 +70834,7 @@ stage: Added - name: Added6586 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2633\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70850,7 +70850,7 @@ stage: Added - name: Added6587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2633\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2633\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70859,7 +70859,7 @@ stage: Added - name: Added6588 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2634\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70875,7 +70875,7 @@ stage: Added - name: Added6589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2634\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2634\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70884,7 +70884,7 @@ stage: Added - name: Added6590 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2635\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70900,7 +70900,7 @@ stage: Added - name: Added6591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2635\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2635\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70909,7 +70909,7 @@ stage: Added - name: Added6592 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2636\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70925,7 +70925,7 @@ stage: Added - name: Added6593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2636\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2636\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70934,7 +70934,7 @@ stage: Added - name: Added6594 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2637\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70950,7 +70950,7 @@ stage: Added - name: Added6595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2637\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2637\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70959,7 +70959,7 @@ stage: Added - name: Added6596 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2638\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -70975,7 +70975,7 @@ stage: Added - name: Added6597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2638\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2638\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -70984,7 +70984,7 @@ stage: Added - name: Added6598 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2639\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71000,7 +71000,7 @@ stage: Added - name: Added6599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2639\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2639\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71009,7 +71009,7 @@ stage: Added - name: Added6600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71017,7 +71017,7 @@ stage: Added - name: Added6601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71026,7 +71026,7 @@ stage: Added - name: Modified6602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71034,7 +71034,7 @@ stage: Modified - name: Added6603 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71042,7 +71042,7 @@ stage: Added - name: Added6604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71051,7 +71051,7 @@ stage: Added - name: Modified6605 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71059,7 +71059,7 @@ stage: Modified - name: Added6606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71067,7 +71067,7 @@ stage: Added - name: Added6607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71076,7 +71076,7 @@ stage: Added - name: Modified6608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71084,7 +71084,7 @@ stage: Modified - name: Added6609 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71092,7 +71092,7 @@ stage: Added - name: Added6610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71101,7 +71101,7 @@ stage: Added - name: Modified6611 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71109,7 +71109,7 @@ stage: Modified - name: Added6612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71117,7 +71117,7 @@ stage: Added - name: Added6613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71126,7 +71126,7 @@ stage: Added - name: Modified6614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71134,7 +71134,7 @@ stage: Modified - name: Added6615 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71142,7 +71142,7 @@ stage: Added - name: Added6616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71151,7 +71151,7 @@ stage: Added - name: Modified6617 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71159,7 +71159,7 @@ stage: Modified - name: Added6618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71167,7 +71167,7 @@ stage: Added - name: Added6619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71176,7 +71176,7 @@ stage: Added - name: Modified6620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71184,7 +71184,7 @@ stage: Modified - name: Added6621 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71192,7 +71192,7 @@ stage: Added - name: Added6622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71201,7 +71201,7 @@ stage: Added - name: Modified6623 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"bffefd69e333f5a654bc54b0e6f802da00c72ce0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -71209,7 +71209,7 @@ stage: Modified - name: Added6624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2648\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2648\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -71217,7 +71217,7 @@ stage: Added - name: Added6625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2648\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2648\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71226,7 +71226,7 @@ stage: Added - name: Added6626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2649\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2649\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -71234,7 +71234,7 @@ stage: Added - name: Added6627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2649\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2649\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71243,7 +71243,7 @@ stage: Added - name: Added6628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2650\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2650\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -71251,7 +71251,7 @@ stage: Added - name: Added6629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2650\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2650\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71260,7 +71260,7 @@ stage: Added - name: Added6630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2651\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2651\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -71268,7 +71268,7 @@ stage: Added - name: Added6631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2651\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2651\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71277,7 +71277,7 @@ stage: Added - name: Added6632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2652\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2652\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -71285,7 +71285,7 @@ stage: Added - name: Added6633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2652\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2652\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71294,7 +71294,7 @@ stage: Added - name: Added6634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2653\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2653\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -71302,7 +71302,7 @@ stage: Added - name: Added6635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2653\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2653\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71311,7 +71311,7 @@ stage: Added - name: Added6636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2654\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2654\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -71319,7 +71319,7 @@ stage: Added - name: Added6637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2654\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2654\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71328,7 +71328,7 @@ stage: Added - name: Added6638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2655\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2655\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -71336,7 +71336,7 @@ stage: Added - name: Added6639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2655\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2655\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71345,7 +71345,7 @@ stage: Added - name: Added6640 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71360,7 +71360,7 @@ stage: Added - name: Added6641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71369,7 +71369,7 @@ stage: Added - name: Modified6642 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71388,7 +71388,7 @@ stage: Modified - name: Added6643 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71403,7 +71403,7 @@ stage: Added - name: Added6644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71412,7 +71412,7 @@ stage: Added - name: Modified6645 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71431,7 +71431,7 @@ stage: Modified - name: Added6646 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71446,7 +71446,7 @@ stage: Added - name: Added6647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71455,7 +71455,7 @@ stage: Added - name: Modified6648 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71474,7 +71474,7 @@ stage: Modified - name: Added6649 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71489,7 +71489,7 @@ stage: Added - name: Added6650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71498,7 +71498,7 @@ stage: Added - name: Modified6651 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71517,7 +71517,7 @@ stage: Modified - name: Added6652 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71532,7 +71532,7 @@ stage: Added - name: Added6653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71541,7 +71541,7 @@ stage: Added - name: Modified6654 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71560,7 +71560,7 @@ stage: Modified - name: Added6655 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71575,7 +71575,7 @@ stage: Added - name: Added6656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71584,7 +71584,7 @@ stage: Added - name: Modified6657 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71603,7 +71603,7 @@ stage: Modified - name: Added6658 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71618,7 +71618,7 @@ stage: Added - name: Added6659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71627,7 +71627,7 @@ stage: Added - name: Modified6660 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71646,7 +71646,7 @@ stage: Modified - name: Added6661 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71661,7 +71661,7 @@ stage: Added - name: Added6662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71670,7 +71670,7 @@ stage: Added - name: Modified6663 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71689,7 +71689,7 @@ stage: Modified - name: Added6664 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2664\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71704,7 +71704,7 @@ stage: Added - name: Added6665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2664\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2664\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71713,7 +71713,7 @@ stage: Added - name: Added6666 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2665\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71728,7 +71728,7 @@ stage: Added - name: Added6667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2665\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2665\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71737,7 +71737,7 @@ stage: Added - name: Added6668 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2666\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71752,7 +71752,7 @@ stage: Added - name: Added6669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2666\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2666\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71761,7 +71761,7 @@ stage: Added - name: Added6670 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2667\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71776,7 +71776,7 @@ stage: Added - name: Added6671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2667\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2667\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71785,7 +71785,7 @@ stage: Added - name: Added6672 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2668\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71800,7 +71800,7 @@ stage: Added - name: Added6673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2668\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2668\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71809,7 +71809,7 @@ stage: Added - name: Added6674 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2669\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71824,7 +71824,7 @@ stage: Added - name: Added6675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2669\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2669\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71833,7 +71833,7 @@ stage: Added - name: Added6676 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2670\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71848,7 +71848,7 @@ stage: Added - name: Added6677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2670\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2670\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71857,7 +71857,7 @@ stage: Added - name: Added6678 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2671\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -71872,7 +71872,7 @@ stage: Added - name: Added6679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2671\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2671\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71881,14 +71881,14 @@ stage: Added - name: Added6680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71897,21 +71897,21 @@ stage: Added - name: Modified6682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6683 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71920,21 +71920,21 @@ stage: Added - name: Modified6685 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71943,21 +71943,21 @@ stage: Added - name: Modified6688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71966,21 +71966,21 @@ stage: Added - name: Modified6691 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -71989,21 +71989,21 @@ stage: Added - name: Modified6694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72012,21 +72012,21 @@ stage: Added - name: Modified6697 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72035,21 +72035,21 @@ stage: Added - name: Modified6700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6701 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Added - name: Added6702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72058,21 +72058,21 @@ stage: Added - name: Modified6703 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722885,"checksum":"f4ff0f0cac42953baefe844dc10933277c9f0edb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "mtime": 1606723058, "checksum": "2cec1a3416975b0d6564202b7da4cf51efd78363"}}' stage: Modified - name: Added6704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2680\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2680\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2680\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2680\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72081,14 +72081,14 @@ stage: Added - name: Added6706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2681\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2681\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2681\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2681\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72097,14 +72097,14 @@ stage: Added - name: Added6708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2682\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2682\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2682\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2682\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72113,14 +72113,14 @@ stage: Added - name: Added6710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2683\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2683\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2683\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2683\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72129,14 +72129,14 @@ stage: Added - name: Added6712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2684\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2684\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2684\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2684\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72145,14 +72145,14 @@ stage: Added - name: Added6714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2685\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2685\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2685\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2685\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72161,14 +72161,14 @@ stage: Added - name: Added6716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2686\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2686\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2686\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2686\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72177,14 +72177,14 @@ stage: Added - name: Added6718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2687\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2687\\reg_key", "arch": "[x64]", "timestamp": 1606769883, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added6719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2687\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2687\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72193,7 +72193,7 @@ stage: Added - name: Added6720 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72209,7 +72209,7 @@ stage: Added - name: Added6721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72218,7 +72218,7 @@ stage: Added - name: Modified6722 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72238,7 +72238,7 @@ stage: Modified - name: Added6723 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769883,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72254,7 +72254,7 @@ stage: Added - name: Added6724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769883,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72263,7 +72263,7 @@ stage: Added - name: Modified6725 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72283,7 +72283,7 @@ stage: Modified - name: Added6726 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72299,7 +72299,7 @@ stage: Added - name: Added6727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72308,7 +72308,7 @@ stage: Added - name: Modified6728 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72328,7 +72328,7 @@ stage: Modified - name: Added6729 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72344,7 +72344,7 @@ stage: Added - name: Added6730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72353,7 +72353,7 @@ stage: Added - name: Modified6731 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72373,7 +72373,7 @@ stage: Modified - name: Added6732 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72389,7 +72389,7 @@ stage: Added - name: Added6733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72398,7 +72398,7 @@ stage: Added - name: Modified6734 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72418,7 +72418,7 @@ stage: Modified - name: Added6735 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72434,7 +72434,7 @@ stage: Added - name: Added6736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72443,7 +72443,7 @@ stage: Added - name: Modified6737 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72463,7 +72463,7 @@ stage: Modified - name: Added6738 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72479,7 +72479,7 @@ stage: Added - name: Added6739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72488,7 +72488,7 @@ stage: Added - name: Modified6740 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72508,7 +72508,7 @@ stage: Modified - name: Added6741 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72524,7 +72524,7 @@ stage: Added - name: Added6742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72533,7 +72533,7 @@ stage: Added - name: Modified6743 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72553,7 +72553,7 @@ stage: Modified - name: Added6744 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2696\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72569,7 +72569,7 @@ stage: Added - name: Added6745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2696\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2696\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72578,7 +72578,7 @@ stage: Added - name: Added6746 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2697\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72594,7 +72594,7 @@ stage: Added - name: Added6747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2697\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2697\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72603,7 +72603,7 @@ stage: Added - name: Added6748 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2698\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72619,7 +72619,7 @@ stage: Added - name: Added6749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2698\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2698\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72628,7 +72628,7 @@ stage: Added - name: Added6750 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2699\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72644,7 +72644,7 @@ stage: Added - name: Added6751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2699\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2699\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72653,7 +72653,7 @@ stage: Added - name: Added6752 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2700\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72669,7 +72669,7 @@ stage: Added - name: Added6753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2700\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2700\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72678,7 +72678,7 @@ stage: Added - name: Added6754 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2701\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72694,7 +72694,7 @@ stage: Added - name: Added6755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2701\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2701\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72703,7 +72703,7 @@ stage: Added - name: Added6756 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2702\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72719,7 +72719,7 @@ stage: Added - name: Added6757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2702\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2702\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72728,7 +72728,7 @@ stage: Added - name: Added6758 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2703\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -72744,7 +72744,7 @@ stage: Added - name: Added6759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2703\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2703\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72753,7 +72753,7 @@ stage: Added - name: Added6760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72761,7 +72761,7 @@ stage: Added - name: Added6761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72770,7 +72770,7 @@ stage: Added - name: Modified6762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72778,7 +72778,7 @@ stage: Modified - name: Added6763 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72786,7 +72786,7 @@ stage: Added - name: Added6764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72795,7 +72795,7 @@ stage: Added - name: Modified6765 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72803,7 +72803,7 @@ stage: Modified - name: Added6766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72811,7 +72811,7 @@ stage: Added - name: Added6767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72820,7 +72820,7 @@ stage: Added - name: Modified6768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72828,7 +72828,7 @@ stage: Modified - name: Added6769 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72836,7 +72836,7 @@ stage: Added - name: Added6770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72845,7 +72845,7 @@ stage: Added - name: Modified6771 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72853,7 +72853,7 @@ stage: Modified - name: Added6772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72861,7 +72861,7 @@ stage: Added - name: Added6773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72870,7 +72870,7 @@ stage: Added - name: Modified6774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72878,7 +72878,7 @@ stage: Modified - name: Added6775 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72886,7 +72886,7 @@ stage: Added - name: Added6776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72895,7 +72895,7 @@ stage: Added - name: Modified6777 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72903,7 +72903,7 @@ stage: Modified - name: Added6778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72911,7 +72911,7 @@ stage: Added - name: Added6779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72920,7 +72920,7 @@ stage: Added - name: Modified6780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72928,7 +72928,7 @@ stage: Modified - name: Added6781 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72936,7 +72936,7 @@ stage: Added - name: Added6782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72945,7 +72945,7 @@ stage: Added - name: Modified6783 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722885,"checksum":"86b45809ae25ba449f14fd8a49a0f569bf7936fd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72953,7 +72953,7 @@ stage: Modified - name: Added6784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72961,7 +72961,7 @@ stage: Added - name: Added6785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72970,7 +72970,7 @@ stage: Added - name: Added6786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72978,7 +72978,7 @@ stage: Added - name: Added6787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -72987,7 +72987,7 @@ stage: Added - name: Added6788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -72995,7 +72995,7 @@ stage: Added - name: Added6789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73004,7 +73004,7 @@ stage: Added - name: Added6790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -73012,7 +73012,7 @@ stage: Added - name: Added6791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73021,7 +73021,7 @@ stage: Added - name: Added6792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -73029,7 +73029,7 @@ stage: Added - name: Added6793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73038,7 +73038,7 @@ stage: Added - name: Added6794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -73046,7 +73046,7 @@ stage: Added - name: Added6795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73055,7 +73055,7 @@ stage: Added - name: Added6796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -73063,7 +73063,7 @@ stage: Added - name: Added6797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73072,7 +73072,7 @@ stage: Added - name: Added6798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -73080,7 +73080,7 @@ stage: Added - name: Added6799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73089,7 +73089,7 @@ stage: Added - name: Added6800 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73105,7 +73105,7 @@ stage: Added - name: Added6801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73114,7 +73114,7 @@ stage: Added - name: Modified6802 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73134,7 +73134,7 @@ stage: Modified - name: Added6803 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73150,7 +73150,7 @@ stage: Added - name: Added6804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73159,7 +73159,7 @@ stage: Added - name: Modified6805 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73179,7 +73179,7 @@ stage: Modified - name: Added6806 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73195,7 +73195,7 @@ stage: Added - name: Added6807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73204,7 +73204,7 @@ stage: Added - name: Modified6808 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73224,7 +73224,7 @@ stage: Modified - name: Added6809 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73240,7 +73240,7 @@ stage: Added - name: Added6810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73249,7 +73249,7 @@ stage: Added - name: Modified6811 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73269,7 +73269,7 @@ stage: Modified - name: Added6812 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73285,7 +73285,7 @@ stage: Added - name: Added6813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73294,7 +73294,7 @@ stage: Added - name: Modified6814 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73314,7 +73314,7 @@ stage: Modified - name: Added6815 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73330,7 +73330,7 @@ stage: Added - name: Added6816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73339,7 +73339,7 @@ stage: Added - name: Modified6817 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73359,7 +73359,7 @@ stage: Modified - name: Added6818 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73375,7 +73375,7 @@ stage: Added - name: Added6819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73384,7 +73384,7 @@ stage: Added - name: Modified6820 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73404,7 +73404,7 @@ stage: Modified - name: Added6821 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73420,7 +73420,7 @@ stage: Added - name: Added6822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73429,7 +73429,7 @@ stage: Added - name: Modified6823 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73449,7 +73449,7 @@ stage: Modified - name: Added6824 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2728\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73464,7 +73464,7 @@ stage: Added - name: Added6825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2728\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2728\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73473,7 +73473,7 @@ stage: Added - name: Added6826 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2729\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73488,7 +73488,7 @@ stage: Added - name: Added6827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2729\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2729\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73497,7 +73497,7 @@ stage: Added - name: Added6828 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2730\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73512,7 +73512,7 @@ stage: Added - name: Added6829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2730\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2730\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73521,7 +73521,7 @@ stage: Added - name: Added6830 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2731\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73536,7 +73536,7 @@ stage: Added - name: Added6831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2731\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2731\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73545,7 +73545,7 @@ stage: Added - name: Added6832 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2732\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73560,7 +73560,7 @@ stage: Added - name: Added6833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2732\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2732\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73569,7 +73569,7 @@ stage: Added - name: Added6834 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2733\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73584,7 +73584,7 @@ stage: Added - name: Added6835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2733\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2733\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73593,7 +73593,7 @@ stage: Added - name: Added6836 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2734\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73608,7 +73608,7 @@ stage: Added - name: Added6837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2734\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2734\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73617,7 +73617,7 @@ stage: Added - name: Added6838 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2735\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73632,7 +73632,7 @@ stage: Added - name: Added6839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2735\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2735\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73641,7 +73641,7 @@ stage: Added - name: Added6840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73649,7 +73649,7 @@ stage: Added - name: Added6841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73658,7 +73658,7 @@ stage: Added - name: Modified6842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73666,7 +73666,7 @@ stage: Modified - name: Added6843 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73674,7 +73674,7 @@ stage: Added - name: Added6844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73683,7 +73683,7 @@ stage: Added - name: Modified6845 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73691,7 +73691,7 @@ stage: Modified - name: Added6846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73699,7 +73699,7 @@ stage: Added - name: Added6847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73708,7 +73708,7 @@ stage: Added - name: Modified6848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73716,7 +73716,7 @@ stage: Modified - name: Added6849 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73724,7 +73724,7 @@ stage: Added - name: Added6850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73733,7 +73733,7 @@ stage: Added - name: Modified6851 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73741,7 +73741,7 @@ stage: Modified - name: Added6852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73749,7 +73749,7 @@ stage: Added - name: Added6853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73758,7 +73758,7 @@ stage: Added - name: Modified6854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73766,7 +73766,7 @@ stage: Modified - name: Added6855 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73774,7 +73774,7 @@ stage: Added - name: Added6856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73783,7 +73783,7 @@ stage: Added - name: Modified6857 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73791,7 +73791,7 @@ stage: Modified - name: Added6858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73799,7 +73799,7 @@ stage: Added - name: Added6859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73808,7 +73808,7 @@ stage: Added - name: Modified6860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73816,7 +73816,7 @@ stage: Modified - name: Added6861 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73824,7 +73824,7 @@ stage: Added - name: Added6862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73833,7 +73833,7 @@ stage: Added - name: Modified6863 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722885,"checksum":"5116f607c2221f8fcca029669aa44c2c3e3d2000"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -73841,14 +73841,14 @@ stage: Modified - name: Added6864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73857,14 +73857,14 @@ stage: Added - name: Added6866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73873,14 +73873,14 @@ stage: Added - name: Added6868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73889,14 +73889,14 @@ stage: Added - name: Added6870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73905,14 +73905,14 @@ stage: Added - name: Added6872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73921,14 +73921,14 @@ stage: Added - name: Added6874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73937,14 +73937,14 @@ stage: Added - name: Added6876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73953,14 +73953,14 @@ stage: Added - name: Added6878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added6879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73969,7 +73969,7 @@ stage: Added - name: Added6880 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -73985,7 +73985,7 @@ stage: Added - name: Added6881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -73994,7 +73994,7 @@ stage: Added - name: Modified6882 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74014,7 +74014,7 @@ stage: Modified - name: Added6883 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74030,7 +74030,7 @@ stage: Added - name: Added6884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74039,7 +74039,7 @@ stage: Added - name: Modified6885 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74059,7 +74059,7 @@ stage: Modified - name: Added6886 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74075,7 +74075,7 @@ stage: Added - name: Added6887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74084,7 +74084,7 @@ stage: Added - name: Modified6888 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74104,7 +74104,7 @@ stage: Modified - name: Added6889 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74120,7 +74120,7 @@ stage: Added - name: Added6890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74129,7 +74129,7 @@ stage: Added - name: Modified6891 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74149,7 +74149,7 @@ stage: Modified - name: Added6892 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74165,7 +74165,7 @@ stage: Added - name: Added6893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74174,7 +74174,7 @@ stage: Added - name: Modified6894 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74194,7 +74194,7 @@ stage: Modified - name: Added6895 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74210,7 +74210,7 @@ stage: Added - name: Added6896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74219,7 +74219,7 @@ stage: Added - name: Modified6897 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74239,7 +74239,7 @@ stage: Modified - name: Added6898 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74255,7 +74255,7 @@ stage: Added - name: Added6899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74264,7 +74264,7 @@ stage: Added - name: Modified6900 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74284,7 +74284,7 @@ stage: Modified - name: Added6901 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74300,7 +74300,7 @@ stage: Added - name: Added6902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74309,7 +74309,7 @@ stage: Added - name: Modified6903 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74329,7 +74329,7 @@ stage: Modified - name: Added6904 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2760\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74345,7 +74345,7 @@ stage: Added - name: Added6905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2760\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2760\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74354,7 +74354,7 @@ stage: Added - name: Added6906 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2761\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74370,7 +74370,7 @@ stage: Added - name: Added6907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2761\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2761\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74379,7 +74379,7 @@ stage: Added - name: Added6908 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2762\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74395,7 +74395,7 @@ stage: Added - name: Added6909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2762\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2762\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74404,7 +74404,7 @@ stage: Added - name: Added6910 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2763\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74420,7 +74420,7 @@ stage: Added - name: Added6911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2763\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2763\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74429,7 +74429,7 @@ stage: Added - name: Added6912 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2764\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74445,7 +74445,7 @@ stage: Added - name: Added6913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2764\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2764\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74454,7 +74454,7 @@ stage: Added - name: Added6914 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2765\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74470,7 +74470,7 @@ stage: Added - name: Added6915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2765\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2765\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74479,7 +74479,7 @@ stage: Added - name: Added6916 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2766\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74495,7 +74495,7 @@ stage: Added - name: Added6917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2766\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2766\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74504,7 +74504,7 @@ stage: Added - name: Added6918 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2767\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74520,7 +74520,7 @@ stage: Added - name: Added6919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2767\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2767\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74529,7 +74529,7 @@ stage: Added - name: Added6920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74537,7 +74537,7 @@ stage: Added - name: Added6921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74546,7 +74546,7 @@ stage: Added - name: Modified6922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74554,7 +74554,7 @@ stage: Modified - name: Added6923 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74562,7 +74562,7 @@ stage: Added - name: Added6924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74571,7 +74571,7 @@ stage: Added - name: Modified6925 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74579,7 +74579,7 @@ stage: Modified - name: Added6926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74587,7 +74587,7 @@ stage: Added - name: Added6927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74596,7 +74596,7 @@ stage: Added - name: Modified6928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74604,7 +74604,7 @@ stage: Modified - name: Added6929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74612,7 +74612,7 @@ stage: Added - name: Added6930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74621,7 +74621,7 @@ stage: Added - name: Modified6931 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74629,7 +74629,7 @@ stage: Modified - name: Added6932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74637,7 +74637,7 @@ stage: Added - name: Added6933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74646,7 +74646,7 @@ stage: Added - name: Modified6934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74654,7 +74654,7 @@ stage: Modified - name: Added6935 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74662,7 +74662,7 @@ stage: Added - name: Added6936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74671,7 +74671,7 @@ stage: Added - name: Modified6937 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74679,7 +74679,7 @@ stage: Modified - name: Added6938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74687,7 +74687,7 @@ stage: Added - name: Added6939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74696,7 +74696,7 @@ stage: Added - name: Modified6940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74704,7 +74704,7 @@ stage: Modified - name: Added6941 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74712,7 +74712,7 @@ stage: Added - name: Added6942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74721,7 +74721,7 @@ stage: Added - name: Modified6943 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -74729,7 +74729,7 @@ stage: Modified - name: Added6944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2776\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2776\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -74737,7 +74737,7 @@ stage: Added - name: Added6945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2776\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2776\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74746,7 +74746,7 @@ stage: Added - name: Added6946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2777\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2777\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -74754,7 +74754,7 @@ stage: Added - name: Added6947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2777\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2777\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74763,7 +74763,7 @@ stage: Added - name: Added6948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2778\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2778\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -74771,7 +74771,7 @@ stage: Added - name: Added6949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2778\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2778\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74780,7 +74780,7 @@ stage: Added - name: Added6950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2779\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2779\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -74788,7 +74788,7 @@ stage: Added - name: Added6951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2779\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2779\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74797,7 +74797,7 @@ stage: Added - name: Added6952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2780\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2780\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -74805,7 +74805,7 @@ stage: Added - name: Added6953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2780\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2780\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74814,7 +74814,7 @@ stage: Added - name: Added6954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2781\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2781\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -74822,7 +74822,7 @@ stage: Added - name: Added6955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2781\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2781\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74831,7 +74831,7 @@ stage: Added - name: Added6956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2782\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2782\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -74839,7 +74839,7 @@ stage: Added - name: Added6957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2782\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2782\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74848,7 +74848,7 @@ stage: Added - name: Added6958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2783\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2783\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -74856,7 +74856,7 @@ stage: Added - name: Added6959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2783\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2783\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74865,7 +74865,7 @@ stage: Added - name: Added6960 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74880,7 +74880,7 @@ stage: Added - name: Added6961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74889,7 +74889,7 @@ stage: Added - name: Modified6962 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74908,7 +74908,7 @@ stage: Modified - name: Added6963 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74923,7 +74923,7 @@ stage: Added - name: Added6964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74932,7 +74932,7 @@ stage: Added - name: Modified6965 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74951,7 +74951,7 @@ stage: Modified - name: Added6966 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74966,7 +74966,7 @@ stage: Added - name: Added6967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -74975,7 +74975,7 @@ stage: Added - name: Modified6968 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -74994,7 +74994,7 @@ stage: Modified - name: Added6969 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75009,7 +75009,7 @@ stage: Added - name: Added6970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75018,7 +75018,7 @@ stage: Added - name: Modified6971 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75037,7 +75037,7 @@ stage: Modified - name: Added6972 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75052,7 +75052,7 @@ stage: Added - name: Added6973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75061,7 +75061,7 @@ stage: Added - name: Modified6974 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75080,7 +75080,7 @@ stage: Modified - name: Added6975 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75095,7 +75095,7 @@ stage: Added - name: Added6976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75104,7 +75104,7 @@ stage: Added - name: Modified6977 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75123,7 +75123,7 @@ stage: Modified - name: Added6978 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75138,7 +75138,7 @@ stage: Added - name: Added6979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75147,7 +75147,7 @@ stage: Added - name: Modified6980 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75166,7 +75166,7 @@ stage: Modified - name: Added6981 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75181,7 +75181,7 @@ stage: Added - name: Added6982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75190,7 +75190,7 @@ stage: Added - name: Modified6983 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75209,7 +75209,7 @@ stage: Modified - name: Added6984 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2792\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75224,7 +75224,7 @@ stage: Added - name: Added6985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2792\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2792\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75233,7 +75233,7 @@ stage: Added - name: Added6986 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2793\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75248,7 +75248,7 @@ stage: Added - name: Added6987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2793\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2793\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75257,7 +75257,7 @@ stage: Added - name: Added6988 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2794\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75272,7 +75272,7 @@ stage: Added - name: Added6989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2794\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2794\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75281,7 +75281,7 @@ stage: Added - name: Added6990 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2795\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75296,7 +75296,7 @@ stage: Added - name: Added6991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2795\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2795\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75305,7 +75305,7 @@ stage: Added - name: Added6992 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2796\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75320,7 +75320,7 @@ stage: Added - name: Added6993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2796\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2796\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75329,7 +75329,7 @@ stage: Added - name: Added6994 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2797\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75344,7 +75344,7 @@ stage: Added - name: Added6995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2797\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2797\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75353,7 +75353,7 @@ stage: Added - name: Added6996 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2798\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75368,7 +75368,7 @@ stage: Added - name: Added6997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2798\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2798\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75377,7 +75377,7 @@ stage: Added - name: Added6998 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2799\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75392,7 +75392,7 @@ stage: Added - name: Added6999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2799\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2799\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75401,14 +75401,14 @@ stage: Added - name: Added7000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Added - name: Added7001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75417,21 +75417,21 @@ stage: Added - name: Modified7002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Modified - name: Added7003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Added - name: Added7004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75440,21 +75440,21 @@ stage: Added - name: Modified7005 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Modified - name: Added7006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Added - name: Added7007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75463,21 +75463,21 @@ stage: Added - name: Modified7008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Modified - name: Added7009 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Added - name: Added7010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75486,21 +75486,21 @@ stage: Added - name: Modified7011 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Modified - name: Added7012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Added - name: Added7013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75509,21 +75509,21 @@ stage: Added - name: Modified7014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Modified - name: Added7015 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Added - name: Added7016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75532,21 +75532,21 @@ stage: Added - name: Modified7017 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Modified - name: Added7018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Added - name: Added7019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75555,21 +75555,21 @@ stage: Added - name: Modified7020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Modified - name: Added7021 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Added - name: Added7022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75578,21 +75578,21 @@ stage: Added - name: Modified7023 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "mtime": 1606723059, "checksum": "27025825f707642bef06b26085941cc9b734b44e"}}' stage: Modified - name: Added7024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2808\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2808\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2808\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2808\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75601,14 +75601,14 @@ stage: Added - name: Added7026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2809\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2809\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2809\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2809\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75617,14 +75617,14 @@ stage: Added - name: Added7028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2810\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2810\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2810\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2810\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75633,14 +75633,14 @@ stage: Added - name: Added7030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2811\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2811\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2811\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2811\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75649,14 +75649,14 @@ stage: Added - name: Added7032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2812\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2812\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2812\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2812\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75665,14 +75665,14 @@ stage: Added - name: Added7034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2813\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2813\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2813\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2813\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75681,14 +75681,14 @@ stage: Added - name: Added7036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2814\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2814\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2814\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2814\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75697,14 +75697,14 @@ stage: Added - name: Added7038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2815\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2815\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2815\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2815\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75713,7 +75713,7 @@ stage: Added - name: Added7040 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75729,7 +75729,7 @@ stage: Added - name: Added7041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75737,7 +75737,7 @@ stage: Added - name: Modified7042 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75757,7 +75757,7 @@ stage: Modified - name: Added7043 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75773,7 +75773,7 @@ stage: Added - name: Added7044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75781,7 +75781,7 @@ stage: Added - name: Modified7045 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75801,7 +75801,7 @@ stage: Modified - name: Added7046 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75817,7 +75817,7 @@ stage: Added - name: Added7047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75825,7 +75825,7 @@ stage: Added - name: Modified7048 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75845,7 +75845,7 @@ stage: Modified - name: Added7049 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75861,7 +75861,7 @@ stage: Added - name: Added7050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75869,7 +75869,7 @@ stage: Added - name: Modified7051 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75889,7 +75889,7 @@ stage: Modified - name: Added7052 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75905,7 +75905,7 @@ stage: Added - name: Added7053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75913,7 +75913,7 @@ stage: Added - name: Modified7054 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75933,7 +75933,7 @@ stage: Modified - name: Added7055 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75949,7 +75949,7 @@ stage: Added - name: Added7056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -75957,7 +75957,7 @@ stage: Added - name: Modified7057 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75977,7 +75977,7 @@ stage: Modified - name: Added7058 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -75993,7 +75993,7 @@ stage: Added - name: Added7059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76001,7 +76001,7 @@ stage: Added - name: Modified7060 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76021,7 +76021,7 @@ stage: Modified - name: Added7061 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76037,7 +76037,7 @@ stage: Added - name: Added7062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76045,7 +76045,7 @@ stage: Added - name: Modified7063 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76065,7 +76065,7 @@ stage: Modified - name: Added7064 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2824\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76081,7 +76081,7 @@ stage: Added - name: Added7065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2824\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2824\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76089,7 +76089,7 @@ stage: Added - name: Added7066 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2825\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76105,7 +76105,7 @@ stage: Added - name: Added7067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2825\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2825\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76113,7 +76113,7 @@ stage: Added - name: Added7068 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2826\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76129,7 +76129,7 @@ stage: Added - name: Added7069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2826\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2826\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76137,7 +76137,7 @@ stage: Added - name: Added7070 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2827\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76153,7 +76153,7 @@ stage: Added - name: Added7071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2827\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2827\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76161,7 +76161,7 @@ stage: Added - name: Added7072 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2828\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76177,7 +76177,7 @@ stage: Added - name: Added7073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2828\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2828\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76185,7 +76185,7 @@ stage: Added - name: Added7074 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2829\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76201,7 +76201,7 @@ stage: Added - name: Added7075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2829\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2829\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76209,7 +76209,7 @@ stage: Added - name: Added7076 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2830\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76225,7 +76225,7 @@ stage: Added - name: Added7077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2830\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2830\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76233,7 +76233,7 @@ stage: Added - name: Added7078 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2831\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76249,7 +76249,7 @@ stage: Added - name: Added7079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2831\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2831\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76257,7 +76257,7 @@ stage: Added - name: Added7080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76265,7 +76265,7 @@ stage: Added - name: Added7081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76273,7 +76273,7 @@ stage: Added - name: Modified7082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76281,7 +76281,7 @@ stage: Modified - name: Added7083 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76289,7 +76289,7 @@ stage: Added - name: Added7084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76297,7 +76297,7 @@ stage: Added - name: Modified7085 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76305,7 +76305,7 @@ stage: Modified - name: Added7086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76313,7 +76313,7 @@ stage: Added - name: Added7087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76321,7 +76321,7 @@ stage: Added - name: Modified7088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76329,7 +76329,7 @@ stage: Modified - name: Added7089 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76337,7 +76337,7 @@ stage: Added - name: Added7090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76345,7 +76345,7 @@ stage: Added - name: Modified7091 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76353,7 +76353,7 @@ stage: Modified - name: Added7092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76361,7 +76361,7 @@ stage: Added - name: Added7093 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76369,7 +76369,7 @@ stage: Added - name: Modified7094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76377,7 +76377,7 @@ stage: Modified - name: Added7095 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76385,7 +76385,7 @@ stage: Added - name: Added7096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76393,7 +76393,7 @@ stage: Added - name: Modified7097 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76401,7 +76401,7 @@ stage: Modified - name: Added7098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76409,7 +76409,7 @@ stage: Added - name: Added7099 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76417,7 +76417,7 @@ stage: Added - name: Modified7100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76425,7 +76425,7 @@ stage: Modified - name: Added7101 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76433,7 +76433,7 @@ stage: Added - name: Added7102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76441,7 +76441,7 @@ stage: Added - name: Modified7103 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76449,7 +76449,7 @@ stage: Modified - name: Added7104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76457,7 +76457,7 @@ stage: Added - name: Added7105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76465,7 +76465,7 @@ stage: Added - name: Added7106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76473,7 +76473,7 @@ stage: Added - name: Added7107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76481,7 +76481,7 @@ stage: Added - name: Added7108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76489,7 +76489,7 @@ stage: Added - name: Added7109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76497,7 +76497,7 @@ stage: Added - name: Added7110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76505,7 +76505,7 @@ stage: Added - name: Added7111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76513,7 +76513,7 @@ stage: Added - name: Added7112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76521,7 +76521,7 @@ stage: Added - name: Added7113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76529,7 +76529,7 @@ stage: Added - name: Added7114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76537,7 +76537,7 @@ stage: Added - name: Added7115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76545,7 +76545,7 @@ stage: Added - name: Added7116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76553,7 +76553,7 @@ stage: Added - name: Added7117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76561,7 +76561,7 @@ stage: Added - name: Added7118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -76569,7 +76569,7 @@ stage: Added - name: Added7119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76577,7 +76577,7 @@ stage: Added - name: Added7120 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76593,7 +76593,7 @@ stage: Added - name: Added7121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76601,7 +76601,7 @@ stage: Added - name: Modified7122 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76621,7 +76621,7 @@ stage: Modified - name: Added7123 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76637,7 +76637,7 @@ stage: Added - name: Added7124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76645,7 +76645,7 @@ stage: Added - name: Modified7125 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76665,7 +76665,7 @@ stage: Modified - name: Added7126 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76681,7 +76681,7 @@ stage: Added - name: Added7127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76689,7 +76689,7 @@ stage: Added - name: Modified7128 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76709,7 +76709,7 @@ stage: Modified - name: Added7129 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76725,7 +76725,7 @@ stage: Added - name: Added7130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76733,7 +76733,7 @@ stage: Added - name: Modified7131 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76753,7 +76753,7 @@ stage: Modified - name: Added7132 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76769,7 +76769,7 @@ stage: Added - name: Added7133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76777,7 +76777,7 @@ stage: Added - name: Modified7134 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76797,7 +76797,7 @@ stage: Modified - name: Added7135 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76813,7 +76813,7 @@ stage: Added - name: Added7136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76821,7 +76821,7 @@ stage: Added - name: Modified7137 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76841,7 +76841,7 @@ stage: Modified - name: Added7138 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76857,7 +76857,7 @@ stage: Added - name: Added7139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76865,7 +76865,7 @@ stage: Added - name: Modified7140 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76885,7 +76885,7 @@ stage: Modified - name: Added7141 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76901,7 +76901,7 @@ stage: Added - name: Added7142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76909,7 +76909,7 @@ stage: Added - name: Modified7143 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76929,7 +76929,7 @@ stage: Modified - name: Added7144 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2856\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76944,7 +76944,7 @@ stage: Added - name: Added7145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2856\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2856\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76952,7 +76952,7 @@ stage: Added - name: Added7146 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2857\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76967,7 +76967,7 @@ stage: Added - name: Added7147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2857\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2857\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76975,7 +76975,7 @@ stage: Added - name: Added7148 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2858\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -76990,7 +76990,7 @@ stage: Added - name: Added7149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2858\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2858\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -76998,7 +76998,7 @@ stage: Added - name: Added7150 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2859\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77013,7 +77013,7 @@ stage: Added - name: Added7151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2859\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2859\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77021,7 +77021,7 @@ stage: Added - name: Added7152 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2860\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77036,7 +77036,7 @@ stage: Added - name: Added7153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2860\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2860\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77044,7 +77044,7 @@ stage: Added - name: Added7154 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2861\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77059,7 +77059,7 @@ stage: Added - name: Added7155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2861\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2861\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77067,7 +77067,7 @@ stage: Added - name: Added7156 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2862\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77082,7 +77082,7 @@ stage: Added - name: Added7157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2862\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2862\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77090,7 +77090,7 @@ stage: Added - name: Added7158 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2863\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77105,7 +77105,7 @@ stage: Added - name: Added7159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2863\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2863\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77113,7 +77113,7 @@ stage: Added - name: Added7160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77121,7 +77121,7 @@ stage: Added - name: Added7161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77129,7 +77129,7 @@ stage: Added - name: Modified7162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77137,7 +77137,7 @@ stage: Modified - name: Added7163 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77145,7 +77145,7 @@ stage: Added - name: Added7164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77153,7 +77153,7 @@ stage: Added - name: Modified7165 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77161,7 +77161,7 @@ stage: Modified - name: Added7166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77169,7 +77169,7 @@ stage: Added - name: Added7167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77177,7 +77177,7 @@ stage: Added - name: Modified7168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77185,7 +77185,7 @@ stage: Modified - name: Added7169 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77193,7 +77193,7 @@ stage: Added - name: Added7170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77201,7 +77201,7 @@ stage: Added - name: Modified7171 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77209,7 +77209,7 @@ stage: Modified - name: Added7172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77217,7 +77217,7 @@ stage: Added - name: Added7173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77225,7 +77225,7 @@ stage: Added - name: Modified7174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77233,7 +77233,7 @@ stage: Modified - name: Added7175 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77241,7 +77241,7 @@ stage: Added - name: Added7176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77249,7 +77249,7 @@ stage: Added - name: Modified7177 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77257,7 +77257,7 @@ stage: Modified - name: Added7178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77265,7 +77265,7 @@ stage: Added - name: Added7179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77273,7 +77273,7 @@ stage: Added - name: Modified7180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77281,7 +77281,7 @@ stage: Modified - name: Added7181 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77289,7 +77289,7 @@ stage: Added - name: Added7182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77297,7 +77297,7 @@ stage: Added - name: Modified7183 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723059, @@ -77305,14 +77305,14 @@ stage: Modified - name: Added7184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77320,14 +77320,14 @@ stage: Added - name: Added7186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77335,14 +77335,14 @@ stage: Added - name: Added7188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77350,14 +77350,14 @@ stage: Added - name: Added7190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77365,14 +77365,14 @@ stage: Added - name: Added7192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77380,14 +77380,14 @@ stage: Added - name: Added7194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77395,14 +77395,14 @@ stage: Added - name: Added7196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77410,14 +77410,14 @@ stage: Added - name: Added7198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key", "arch": "[x64]", "timestamp": 1606769884, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77425,7 +77425,7 @@ stage: Added - name: Added7200 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77441,7 +77441,7 @@ stage: Added - name: Added7201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77449,7 +77449,7 @@ stage: Added - name: Modified7202 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77469,7 +77469,7 @@ stage: Modified - name: Added7203 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77485,7 +77485,7 @@ stage: Added - name: Added7204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77493,7 +77493,7 @@ stage: Added - name: Modified7205 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77513,7 +77513,7 @@ stage: Modified - name: Added7206 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77529,7 +77529,7 @@ stage: Added - name: Added7207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77537,7 +77537,7 @@ stage: Added - name: Modified7208 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77557,7 +77557,7 @@ stage: Modified - name: Added7209 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77573,7 +77573,7 @@ stage: Added - name: Added7210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77581,7 +77581,7 @@ stage: Added - name: Modified7211 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77601,7 +77601,7 @@ stage: Modified - name: Added7212 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77617,7 +77617,7 @@ stage: Added - name: Added7213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77625,7 +77625,7 @@ stage: Added - name: Modified7214 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77645,7 +77645,7 @@ stage: Modified - name: Added7215 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77661,7 +77661,7 @@ stage: Added - name: Added7216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77669,7 +77669,7 @@ stage: Added - name: Modified7217 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77689,7 +77689,7 @@ stage: Modified - name: Added7218 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77705,7 +77705,7 @@ stage: Added - name: Added7219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77713,7 +77713,7 @@ stage: Added - name: Modified7220 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77733,7 +77733,7 @@ stage: Modified - name: Added7221 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77749,7 +77749,7 @@ stage: Added - name: Added7222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77757,7 +77757,7 @@ stage: Added - name: Modified7223 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77777,7 +77777,7 @@ stage: Modified - name: Added7224 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2888\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77793,7 +77793,7 @@ stage: Added - name: Added7225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2888\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2888\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77801,7 +77801,7 @@ stage: Added - name: Added7226 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2889\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77817,7 +77817,7 @@ stage: Added - name: Added7227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2889\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2889\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77825,7 +77825,7 @@ stage: Added - name: Added7228 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2890\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77841,7 +77841,7 @@ stage: Added - name: Added7229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2890\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2890\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77849,7 +77849,7 @@ stage: Added - name: Added7230 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2891\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77865,7 +77865,7 @@ stage: Added - name: Added7231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2891\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2891\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77873,7 +77873,7 @@ stage: Added - name: Added7232 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2892\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769884,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77889,7 +77889,7 @@ stage: Added - name: Added7233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2892\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769884,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2892\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769884, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77897,7 +77897,7 @@ stage: Added - name: Added7234 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2893\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77913,7 +77913,7 @@ stage: Added - name: Added7235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2893\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2893\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77921,7 +77921,7 @@ stage: Added - name: Added7236 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2894\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77937,7 +77937,7 @@ stage: Added - name: Added7237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2894\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2894\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77945,7 +77945,7 @@ stage: Added - name: Added7238 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2895\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -77961,7 +77961,7 @@ stage: Added - name: Added7239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2895\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2895\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77969,7 +77969,7 @@ stage: Added - name: Added7240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -77977,7 +77977,7 @@ stage: Added - name: Added7241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -77985,7 +77985,7 @@ stage: Added - name: Modified7242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -77993,7 +77993,7 @@ stage: Modified - name: Added7243 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78001,7 +78001,7 @@ stage: Added - name: Added7244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78009,7 +78009,7 @@ stage: Added - name: Modified7245 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78017,7 +78017,7 @@ stage: Modified - name: Added7246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78025,7 +78025,7 @@ stage: Added - name: Added7247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78033,7 +78033,7 @@ stage: Added - name: Modified7248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78041,7 +78041,7 @@ stage: Modified - name: Added7249 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78049,7 +78049,7 @@ stage: Added - name: Added7250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78057,7 +78057,7 @@ stage: Added - name: Modified7251 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78065,7 +78065,7 @@ stage: Modified - name: Added7252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78073,7 +78073,7 @@ stage: Added - name: Added7253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78081,7 +78081,7 @@ stage: Added - name: Modified7254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78089,7 +78089,7 @@ stage: Modified - name: Added7255 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78097,7 +78097,7 @@ stage: Added - name: Added7256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78105,7 +78105,7 @@ stage: Added - name: Modified7257 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78113,7 +78113,7 @@ stage: Modified - name: Added7258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78121,7 +78121,7 @@ stage: Added - name: Added7259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78129,7 +78129,7 @@ stage: Added - name: Modified7260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78137,7 +78137,7 @@ stage: Modified - name: Added7261 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78145,7 +78145,7 @@ stage: Added - name: Added7262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78153,7 +78153,7 @@ stage: Added - name: Modified7263 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -78161,7 +78161,7 @@ stage: Modified - name: Added7264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2904\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2904\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -78169,7 +78169,7 @@ stage: Added - name: Added7265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2904\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2904\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78177,7 +78177,7 @@ stage: Added - name: Added7266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2905\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2905\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -78185,7 +78185,7 @@ stage: Added - name: Added7267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2905\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2905\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78193,7 +78193,7 @@ stage: Added - name: Added7268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2906\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2906\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -78201,7 +78201,7 @@ stage: Added - name: Added7269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2906\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2906\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78209,7 +78209,7 @@ stage: Added - name: Added7270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2907\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2907\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -78217,7 +78217,7 @@ stage: Added - name: Added7271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2907\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2907\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78225,7 +78225,7 @@ stage: Added - name: Added7272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2908\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2908\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -78233,7 +78233,7 @@ stage: Added - name: Added7273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2908\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2908\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78241,7 +78241,7 @@ stage: Added - name: Added7274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2909\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2909\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -78249,7 +78249,7 @@ stage: Added - name: Added7275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2909\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2909\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78257,7 +78257,7 @@ stage: Added - name: Added7276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2910\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2910\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -78265,7 +78265,7 @@ stage: Added - name: Added7277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2910\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2910\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78273,7 +78273,7 @@ stage: Added - name: Added7278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2911\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2911\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -78281,7 +78281,7 @@ stage: Added - name: Added7279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2911\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2911\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78289,7 +78289,7 @@ stage: Added - name: Added7280 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78304,7 +78304,7 @@ stage: Added - name: Added7281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78312,7 +78312,7 @@ stage: Added - name: Modified7282 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78331,7 +78331,7 @@ stage: Modified - name: Added7283 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78346,7 +78346,7 @@ stage: Added - name: Added7284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78354,7 +78354,7 @@ stage: Added - name: Modified7285 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78373,7 +78373,7 @@ stage: Modified - name: Added7286 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78388,7 +78388,7 @@ stage: Added - name: Added7287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78396,7 +78396,7 @@ stage: Added - name: Modified7288 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78415,7 +78415,7 @@ stage: Modified - name: Added7289 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78430,7 +78430,7 @@ stage: Added - name: Added7290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78438,7 +78438,7 @@ stage: Added - name: Modified7291 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78457,7 +78457,7 @@ stage: Modified - name: Added7292 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78472,7 +78472,7 @@ stage: Added - name: Added7293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78480,7 +78480,7 @@ stage: Added - name: Modified7294 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78499,7 +78499,7 @@ stage: Modified - name: Added7295 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78514,7 +78514,7 @@ stage: Added - name: Added7296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78522,7 +78522,7 @@ stage: Added - name: Modified7297 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78541,7 +78541,7 @@ stage: Modified - name: Added7298 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78556,7 +78556,7 @@ stage: Added - name: Added7299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78564,7 +78564,7 @@ stage: Added - name: Modified7300 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78583,7 +78583,7 @@ stage: Modified - name: Added7301 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78598,7 +78598,7 @@ stage: Added - name: Added7302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78606,7 +78606,7 @@ stage: Added - name: Modified7303 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78625,7 +78625,7 @@ stage: Modified - name: Added7304 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2920\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78640,7 +78640,7 @@ stage: Added - name: Added7305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2920\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2920\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78648,7 +78648,7 @@ stage: Added - name: Added7306 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2921\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78663,7 +78663,7 @@ stage: Added - name: Added7307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2921\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2921\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78671,7 +78671,7 @@ stage: Added - name: Added7308 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2922\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78686,7 +78686,7 @@ stage: Added - name: Added7309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2922\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2922\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78694,7 +78694,7 @@ stage: Added - name: Added7310 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2923\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78709,7 +78709,7 @@ stage: Added - name: Added7311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2923\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2923\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78717,7 +78717,7 @@ stage: Added - name: Added7312 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2924\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78732,7 +78732,7 @@ stage: Added - name: Added7313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2924\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2924\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78740,7 +78740,7 @@ stage: Added - name: Added7314 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2925\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78755,7 +78755,7 @@ stage: Added - name: Added7315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2925\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2925\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78763,7 +78763,7 @@ stage: Added - name: Added7316 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2926\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78778,7 +78778,7 @@ stage: Added - name: Added7317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2926\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2926\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78786,7 +78786,7 @@ stage: Added - name: Added7318 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2927\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -78801,7 +78801,7 @@ stage: Added - name: Added7319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2927\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2927\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78809,14 +78809,14 @@ stage: Added - name: Added7320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Added - name: Added7321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78824,21 +78824,21 @@ stage: Added - name: Modified7322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Modified - name: Added7323 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Added - name: Added7324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78846,21 +78846,21 @@ stage: Added - name: Modified7325 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Modified - name: Added7326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Added - name: Added7327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78868,21 +78868,21 @@ stage: Added - name: Modified7328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Modified - name: Added7329 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Added - name: Added7330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78890,21 +78890,21 @@ stage: Added - name: Modified7331 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Modified - name: Added7332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Added - name: Added7333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78912,21 +78912,21 @@ stage: Added - name: Modified7334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Modified - name: Added7335 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Added - name: Added7336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78934,21 +78934,21 @@ stage: Added - name: Modified7337 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Modified - name: Added7338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Added - name: Added7339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78956,21 +78956,21 @@ stage: Added - name: Modified7340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Modified - name: Added7341 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Added - name: Added7342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -78978,21 +78978,21 @@ stage: Added - name: Modified7343 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723060, "checksum": "e3dc3b80c2150280d6be68e876ad7c344265a484"}}' stage: Modified - name: Added7344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2936\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2936\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2936\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2936\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79000,14 +79000,14 @@ stage: Added - name: Added7346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2937\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2937\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2937\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2937\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79015,14 +79015,14 @@ stage: Added - name: Added7348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2938\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2938\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2938\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2938\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79030,14 +79030,14 @@ stage: Added - name: Added7350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2939\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2939\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2939\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2939\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79045,14 +79045,14 @@ stage: Added - name: Added7352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2940\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2940\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2940\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2940\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79060,14 +79060,14 @@ stage: Added - name: Added7354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2941\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2941\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2941\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2941\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79075,14 +79075,14 @@ stage: Added - name: Added7356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2942\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2942\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2942\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2942\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79090,14 +79090,14 @@ stage: Added - name: Added7358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2943\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2943\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2943\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2943\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79105,7 +79105,7 @@ stage: Added - name: Added7360 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79121,7 +79121,7 @@ stage: Added - name: Added7361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79129,7 +79129,7 @@ stage: Added - name: Modified7362 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79149,7 +79149,7 @@ stage: Modified - name: Added7363 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79165,7 +79165,7 @@ stage: Added - name: Added7364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79173,7 +79173,7 @@ stage: Added - name: Modified7365 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79193,7 +79193,7 @@ stage: Modified - name: Added7366 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79209,7 +79209,7 @@ stage: Added - name: Added7367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79217,7 +79217,7 @@ stage: Added - name: Modified7368 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79237,7 +79237,7 @@ stage: Modified - name: Added7369 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79253,7 +79253,7 @@ stage: Added - name: Added7370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79261,7 +79261,7 @@ stage: Added - name: Modified7371 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79281,7 +79281,7 @@ stage: Modified - name: Added7372 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79297,7 +79297,7 @@ stage: Added - name: Added7373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79305,7 +79305,7 @@ stage: Added - name: Modified7374 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79325,7 +79325,7 @@ stage: Modified - name: Added7375 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79341,7 +79341,7 @@ stage: Added - name: Added7376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79349,7 +79349,7 @@ stage: Added - name: Modified7377 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79369,7 +79369,7 @@ stage: Modified - name: Added7378 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79385,7 +79385,7 @@ stage: Added - name: Added7379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79393,7 +79393,7 @@ stage: Added - name: Modified7380 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79413,7 +79413,7 @@ stage: Modified - name: Added7381 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79429,7 +79429,7 @@ stage: Added - name: Added7382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79437,7 +79437,7 @@ stage: Added - name: Modified7383 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79457,7 +79457,7 @@ stage: Modified - name: Added7384 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2952\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79473,7 +79473,7 @@ stage: Added - name: Added7385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2952\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2952\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79481,7 +79481,7 @@ stage: Added - name: Added7386 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2953\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79497,7 +79497,7 @@ stage: Added - name: Added7387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2953\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2953\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79505,7 +79505,7 @@ stage: Added - name: Added7388 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2954\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79521,7 +79521,7 @@ stage: Added - name: Added7389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2954\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2954\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79529,7 +79529,7 @@ stage: Added - name: Added7390 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2955\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79545,7 +79545,7 @@ stage: Added - name: Added7391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2955\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2955\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79553,7 +79553,7 @@ stage: Added - name: Added7392 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2956\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79569,7 +79569,7 @@ stage: Added - name: Added7393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2956\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2956\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79577,7 +79577,7 @@ stage: Added - name: Added7394 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2957\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79593,7 +79593,7 @@ stage: Added - name: Added7395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2957\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2957\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79601,7 +79601,7 @@ stage: Added - name: Added7396 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2958\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79617,7 +79617,7 @@ stage: Added - name: Added7397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2958\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2958\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79625,7 +79625,7 @@ stage: Added - name: Added7398 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2959\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79641,7 +79641,7 @@ stage: Added - name: Added7399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2959\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2959\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79649,7 +79649,7 @@ stage: Added - name: Added7400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79657,7 +79657,7 @@ stage: Added - name: Added7401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79665,7 +79665,7 @@ stage: Added - name: Modified7402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79673,7 +79673,7 @@ stage: Modified - name: Added7403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79681,7 +79681,7 @@ stage: Added - name: Added7404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79689,7 +79689,7 @@ stage: Added - name: Modified7405 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79697,7 +79697,7 @@ stage: Modified - name: Added7406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79705,7 +79705,7 @@ stage: Added - name: Added7407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79713,7 +79713,7 @@ stage: Added - name: Modified7408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79721,7 +79721,7 @@ stage: Modified - name: Added7409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79729,7 +79729,7 @@ stage: Added - name: Added7410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79737,7 +79737,7 @@ stage: Added - name: Modified7411 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79745,7 +79745,7 @@ stage: Modified - name: Added7412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79753,7 +79753,7 @@ stage: Added - name: Added7413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79761,7 +79761,7 @@ stage: Added - name: Modified7414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79769,7 +79769,7 @@ stage: Modified - name: Added7415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79777,7 +79777,7 @@ stage: Added - name: Added7416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79785,7 +79785,7 @@ stage: Added - name: Modified7417 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79793,7 +79793,7 @@ stage: Modified - name: Added7418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79801,7 +79801,7 @@ stage: Added - name: Added7419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79809,7 +79809,7 @@ stage: Added - name: Modified7420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79817,7 +79817,7 @@ stage: Modified - name: Added7421 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79825,7 +79825,7 @@ stage: Added - name: Added7422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79833,7 +79833,7 @@ stage: Added - name: Modified7423 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79841,7 +79841,7 @@ stage: Modified - name: Added7424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79849,7 +79849,7 @@ stage: Added - name: Added7425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79857,7 +79857,7 @@ stage: Added - name: Added7426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79865,7 +79865,7 @@ stage: Added - name: Added7427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79873,7 +79873,7 @@ stage: Added - name: Added7428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79881,7 +79881,7 @@ stage: Added - name: Added7429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79889,7 +79889,7 @@ stage: Added - name: Added7430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79897,7 +79897,7 @@ stage: Added - name: Added7431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79905,7 +79905,7 @@ stage: Added - name: Added7432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79913,7 +79913,7 @@ stage: Added - name: Added7433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79921,7 +79921,7 @@ stage: Added - name: Added7434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79929,7 +79929,7 @@ stage: Added - name: Added7435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79937,7 +79937,7 @@ stage: Added - name: Added7436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79945,7 +79945,7 @@ stage: Added - name: Added7437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79953,7 +79953,7 @@ stage: Added - name: Added7438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -79961,7 +79961,7 @@ stage: Added - name: Added7439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79969,7 +79969,7 @@ stage: Added - name: Added7440 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -79985,7 +79985,7 @@ stage: Added - name: Added7441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -79993,7 +79993,7 @@ stage: Added - name: Modified7442 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80013,7 +80013,7 @@ stage: Modified - name: Added7443 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80029,7 +80029,7 @@ stage: Added - name: Added7444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80037,7 +80037,7 @@ stage: Added - name: Modified7445 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80057,7 +80057,7 @@ stage: Modified - name: Added7446 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80073,7 +80073,7 @@ stage: Added - name: Added7447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80081,7 +80081,7 @@ stage: Added - name: Modified7448 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80101,7 +80101,7 @@ stage: Modified - name: Added7449 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80117,7 +80117,7 @@ stage: Added - name: Added7450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80125,7 +80125,7 @@ stage: Added - name: Modified7451 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80145,7 +80145,7 @@ stage: Modified - name: Added7452 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80161,7 +80161,7 @@ stage: Added - name: Added7453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80169,7 +80169,7 @@ stage: Added - name: Modified7454 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80189,7 +80189,7 @@ stage: Modified - name: Added7455 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80205,7 +80205,7 @@ stage: Added - name: Added7456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80213,7 +80213,7 @@ stage: Added - name: Modified7457 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80233,7 +80233,7 @@ stage: Modified - name: Added7458 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80249,7 +80249,7 @@ stage: Added - name: Added7459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80257,7 +80257,7 @@ stage: Added - name: Modified7460 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80277,7 +80277,7 @@ stage: Modified - name: Added7461 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80293,7 +80293,7 @@ stage: Added - name: Added7462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80301,7 +80301,7 @@ stage: Added - name: Modified7463 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80321,7 +80321,7 @@ stage: Modified - name: Added7464 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2984\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80336,7 +80336,7 @@ stage: Added - name: Added7465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2984\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2984\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80344,7 +80344,7 @@ stage: Added - name: Added7466 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2985\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80359,7 +80359,7 @@ stage: Added - name: Added7467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2985\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2985\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80367,7 +80367,7 @@ stage: Added - name: Added7468 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2986\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80382,7 +80382,7 @@ stage: Added - name: Added7469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2986\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2986\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80390,7 +80390,7 @@ stage: Added - name: Added7470 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2987\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80405,7 +80405,7 @@ stage: Added - name: Added7471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2987\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2987\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80413,7 +80413,7 @@ stage: Added - name: Added7472 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2988\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80428,7 +80428,7 @@ stage: Added - name: Added7473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2988\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2988\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80436,7 +80436,7 @@ stage: Added - name: Added7474 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2989\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80451,7 +80451,7 @@ stage: Added - name: Added7475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2989\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2989\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80459,7 +80459,7 @@ stage: Added - name: Added7476 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2990\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80474,7 +80474,7 @@ stage: Added - name: Added7477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2990\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2990\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80482,7 +80482,7 @@ stage: Added - name: Added7478 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2991\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80497,7 +80497,7 @@ stage: Added - name: Added7479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2991\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2991\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80505,7 +80505,7 @@ stage: Added - name: Added7480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80513,7 +80513,7 @@ stage: Added - name: Added7481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80521,7 +80521,7 @@ stage: Added - name: Modified7482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80529,7 +80529,7 @@ stage: Modified - name: Added7483 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80537,7 +80537,7 @@ stage: Added - name: Added7484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80545,7 +80545,7 @@ stage: Added - name: Modified7485 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80553,7 +80553,7 @@ stage: Modified - name: Added7486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80561,7 +80561,7 @@ stage: Added - name: Added7487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80569,7 +80569,7 @@ stage: Added - name: Modified7488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80577,7 +80577,7 @@ stage: Modified - name: Added7489 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80585,7 +80585,7 @@ stage: Added - name: Added7490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80593,7 +80593,7 @@ stage: Added - name: Modified7491 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80601,7 +80601,7 @@ stage: Modified - name: Added7492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80609,7 +80609,7 @@ stage: Added - name: Added7493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80617,7 +80617,7 @@ stage: Added - name: Modified7494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80625,7 +80625,7 @@ stage: Modified - name: Added7495 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80633,7 +80633,7 @@ stage: Added - name: Added7496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80641,7 +80641,7 @@ stage: Added - name: Modified7497 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80649,7 +80649,7 @@ stage: Modified - name: Added7498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80657,7 +80657,7 @@ stage: Added - name: Added7499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80665,7 +80665,7 @@ stage: Added - name: Modified7500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80673,7 +80673,7 @@ stage: Modified - name: Added7501 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80681,7 +80681,7 @@ stage: Added - name: Added7502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80689,7 +80689,7 @@ stage: Added - name: Modified7503 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722886,"checksum":"ac7d68a33c5eed25a782444842d203a44139a33e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723060, @@ -80697,14 +80697,14 @@ stage: Modified - name: Added7504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80712,14 +80712,14 @@ stage: Added - name: Added7506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80727,14 +80727,14 @@ stage: Added - name: Added7508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80742,14 +80742,14 @@ stage: Added - name: Added7510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80757,14 +80757,14 @@ stage: Added - name: Added7512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80772,14 +80772,14 @@ stage: Added - name: Added7514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80787,14 +80787,14 @@ stage: Added - name: Added7516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80802,14 +80802,14 @@ stage: Added - name: Added7518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80817,7 +80817,7 @@ stage: Added - name: Added7520 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80833,7 +80833,7 @@ stage: Added - name: Added7521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80841,7 +80841,7 @@ stage: Added - name: Modified7522 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80861,7 +80861,7 @@ stage: Modified - name: Added7523 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80877,7 +80877,7 @@ stage: Added - name: Added7524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80885,7 +80885,7 @@ stage: Added - name: Modified7525 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80905,7 +80905,7 @@ stage: Modified - name: Added7526 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80921,7 +80921,7 @@ stage: Added - name: Added7527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80929,7 +80929,7 @@ stage: Added - name: Modified7528 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80949,7 +80949,7 @@ stage: Modified - name: Added7529 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80965,7 +80965,7 @@ stage: Added - name: Added7530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -80973,7 +80973,7 @@ stage: Added - name: Modified7531 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -80993,7 +80993,7 @@ stage: Modified - name: Added7532 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81009,7 +81009,7 @@ stage: Added - name: Added7533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81017,7 +81017,7 @@ stage: Added - name: Modified7534 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81037,7 +81037,7 @@ stage: Modified - name: Added7535 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81053,7 +81053,7 @@ stage: Added - name: Added7536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81061,7 +81061,7 @@ stage: Added - name: Modified7537 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81081,7 +81081,7 @@ stage: Modified - name: Added7538 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81097,7 +81097,7 @@ stage: Added - name: Added7539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81105,7 +81105,7 @@ stage: Added - name: Modified7540 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81125,7 +81125,7 @@ stage: Modified - name: Added7541 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81141,7 +81141,7 @@ stage: Added - name: Added7542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81149,7 +81149,7 @@ stage: Added - name: Modified7543 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81169,7 +81169,7 @@ stage: Modified - name: Added7544 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3016\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81185,7 +81185,7 @@ stage: Added - name: Added7545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3016\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3016\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81193,7 +81193,7 @@ stage: Added - name: Added7546 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3017\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81209,7 +81209,7 @@ stage: Added - name: Added7547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3017\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3017\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81217,7 +81217,7 @@ stage: Added - name: Added7548 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3018\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81233,7 +81233,7 @@ stage: Added - name: Added7549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3018\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3018\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81241,7 +81241,7 @@ stage: Added - name: Added7550 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3019\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81257,7 +81257,7 @@ stage: Added - name: Added7551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3019\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3019\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81265,7 +81265,7 @@ stage: Added - name: Added7552 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3020\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81281,7 +81281,7 @@ stage: Added - name: Added7553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3020\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3020\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81289,7 +81289,7 @@ stage: Added - name: Added7554 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3021\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81305,7 +81305,7 @@ stage: Added - name: Added7555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3021\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3021\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81313,7 +81313,7 @@ stage: Added - name: Added7556 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3022\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81329,7 +81329,7 @@ stage: Added - name: Added7557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3022\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3022\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81337,7 +81337,7 @@ stage: Added - name: Added7558 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3023\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81353,7 +81353,7 @@ stage: Added - name: Added7559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3023\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3023\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81361,7 +81361,7 @@ stage: Added - name: Added7560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81369,7 +81369,7 @@ stage: Added - name: Added7561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81377,7 +81377,7 @@ stage: Added - name: Modified7562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81385,7 +81385,7 @@ stage: Modified - name: Added7563 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81393,7 +81393,7 @@ stage: Added - name: Added7564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81401,7 +81401,7 @@ stage: Added - name: Modified7565 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81409,7 +81409,7 @@ stage: Modified - name: Added7566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81417,7 +81417,7 @@ stage: Added - name: Added7567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81425,7 +81425,7 @@ stage: Added - name: Modified7568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81433,7 +81433,7 @@ stage: Modified - name: Added7569 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81441,7 +81441,7 @@ stage: Added - name: Added7570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81449,7 +81449,7 @@ stage: Added - name: Modified7571 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81457,7 +81457,7 @@ stage: Modified - name: Added7572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81465,7 +81465,7 @@ stage: Added - name: Added7573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81473,7 +81473,7 @@ stage: Added - name: Modified7574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81481,7 +81481,7 @@ stage: Modified - name: Added7575 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81489,7 +81489,7 @@ stage: Added - name: Added7576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81497,7 +81497,7 @@ stage: Added - name: Modified7577 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81505,7 +81505,7 @@ stage: Modified - name: Added7578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81513,7 +81513,7 @@ stage: Added - name: Added7579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81521,7 +81521,7 @@ stage: Added - name: Modified7580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81529,7 +81529,7 @@ stage: Modified - name: Added7581 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81537,7 +81537,7 @@ stage: Added - name: Added7582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81545,7 +81545,7 @@ stage: Added - name: Modified7583 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"7678a1d4eb78049c64d91ae16c77a705dfbfb292"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -81553,7 +81553,7 @@ stage: Modified - name: Added7584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3032\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3032\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -81561,7 +81561,7 @@ stage: Added - name: Added7585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3032\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3032\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81569,7 +81569,7 @@ stage: Added - name: Added7586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3033\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3033\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -81577,7 +81577,7 @@ stage: Added - name: Added7587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3033\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3033\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81585,7 +81585,7 @@ stage: Added - name: Added7588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3034\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3034\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -81593,7 +81593,7 @@ stage: Added - name: Added7589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3034\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3034\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81601,7 +81601,7 @@ stage: Added - name: Added7590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3035\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3035\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -81609,7 +81609,7 @@ stage: Added - name: Added7591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3035\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3035\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81617,7 +81617,7 @@ stage: Added - name: Added7592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3036\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3036\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -81625,7 +81625,7 @@ stage: Added - name: Added7593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3036\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3036\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81633,7 +81633,7 @@ stage: Added - name: Added7594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3037\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3037\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -81641,7 +81641,7 @@ stage: Added - name: Added7595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3037\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3037\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81649,7 +81649,7 @@ stage: Added - name: Added7596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3038\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3038\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -81657,7 +81657,7 @@ stage: Added - name: Added7597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3038\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3038\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81665,7 +81665,7 @@ stage: Added - name: Added7598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3039\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3039\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -81673,7 +81673,7 @@ stage: Added - name: Added7599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3039\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3039\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81681,7 +81681,7 @@ stage: Added - name: Added7600 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81696,7 +81696,7 @@ stage: Added - name: Added7601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81704,7 +81704,7 @@ stage: Added - name: Modified7602 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81723,7 +81723,7 @@ stage: Modified - name: Added7603 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81738,7 +81738,7 @@ stage: Added - name: Added7604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81746,7 +81746,7 @@ stage: Added - name: Modified7605 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81765,7 +81765,7 @@ stage: Modified - name: Added7606 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81780,7 +81780,7 @@ stage: Added - name: Added7607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81788,7 +81788,7 @@ stage: Added - name: Modified7608 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81807,7 +81807,7 @@ stage: Modified - name: Added7609 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81822,7 +81822,7 @@ stage: Added - name: Added7610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81830,7 +81830,7 @@ stage: Added - name: Modified7611 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81849,7 +81849,7 @@ stage: Modified - name: Added7612 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81864,7 +81864,7 @@ stage: Added - name: Added7613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81872,7 +81872,7 @@ stage: Added - name: Modified7614 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81891,7 +81891,7 @@ stage: Modified - name: Added7615 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81906,7 +81906,7 @@ stage: Added - name: Added7616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81914,7 +81914,7 @@ stage: Added - name: Modified7617 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81933,7 +81933,7 @@ stage: Modified - name: Added7618 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81948,7 +81948,7 @@ stage: Added - name: Added7619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81956,7 +81956,7 @@ stage: Added - name: Modified7620 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81975,7 +81975,7 @@ stage: Modified - name: Added7621 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -81990,7 +81990,7 @@ stage: Added - name: Added7622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -81998,7 +81998,7 @@ stage: Added - name: Modified7623 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82017,7 +82017,7 @@ stage: Modified - name: Added7624 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3048\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82032,7 +82032,7 @@ stage: Added - name: Added7625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3048\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3048\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82040,7 +82040,7 @@ stage: Added - name: Added7626 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3049\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82055,7 +82055,7 @@ stage: Added - name: Added7627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3049\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3049\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82063,7 +82063,7 @@ stage: Added - name: Added7628 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3050\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82078,7 +82078,7 @@ stage: Added - name: Added7629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3050\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3050\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82086,7 +82086,7 @@ stage: Added - name: Added7630 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3051\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82101,7 +82101,7 @@ stage: Added - name: Added7631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3051\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3051\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82109,7 +82109,7 @@ stage: Added - name: Added7632 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3052\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82124,7 +82124,7 @@ stage: Added - name: Added7633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3052\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3052\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82132,7 +82132,7 @@ stage: Added - name: Added7634 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3053\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82147,7 +82147,7 @@ stage: Added - name: Added7635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3053\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3053\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82155,7 +82155,7 @@ stage: Added - name: Added7636 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3054\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82170,7 +82170,7 @@ stage: Added - name: Added7637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3054\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3054\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82178,7 +82178,7 @@ stage: Added - name: Added7638 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3055\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82193,7 +82193,7 @@ stage: Added - name: Added7639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3055\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3055\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82201,14 +82201,14 @@ stage: Added - name: Added7640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Added - name: Added7641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82216,21 +82216,21 @@ stage: Added - name: Modified7642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Modified - name: Added7643 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Added - name: Added7644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82238,21 +82238,21 @@ stage: Added - name: Modified7645 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Modified - name: Added7646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Added - name: Added7647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82260,21 +82260,21 @@ stage: Added - name: Modified7648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Modified - name: Added7649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Added - name: Added7650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82282,21 +82282,21 @@ stage: Added - name: Modified7651 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Modified - name: Added7652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Added - name: Added7653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82304,21 +82304,21 @@ stage: Added - name: Modified7654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Modified - name: Added7655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Added - name: Added7656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82326,21 +82326,21 @@ stage: Added - name: Modified7657 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Modified - name: Added7658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Added - name: Added7659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82348,21 +82348,21 @@ stage: Added - name: Modified7660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Modified - name: Added7661 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Added - name: Added7662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82370,21 +82370,21 @@ stage: Added - name: Modified7663 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722886,"checksum":"bb51ab32e07bff99036b2d661185c6a1da569f3c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "mtime": 1606723061, "checksum": "eae010665beb6216af93aa97ad74c9ffb9fc267f"}}' stage: Modified - name: Added7664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3064\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3064\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3064\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3064\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82392,14 +82392,14 @@ stage: Added - name: Added7666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3065\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3065\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3065\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3065\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82407,14 +82407,14 @@ stage: Added - name: Added7668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3066\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3066\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3066\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3066\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82422,14 +82422,14 @@ stage: Added - name: Added7670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3067\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3067\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3067\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3067\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82437,14 +82437,14 @@ stage: Added - name: Added7672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3068\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3068\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3068\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3068\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82452,14 +82452,14 @@ stage: Added - name: Added7674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3069\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3069\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3069\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3069\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82467,14 +82467,14 @@ stage: Added - name: Added7676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3070\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3070\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3070\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3070\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82482,14 +82482,14 @@ stage: Added - name: Added7678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3071\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3071\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3071\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3071\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "hash_sha1": "172415f02e562cd029620c3db12fb3cbb83c4208", @@ -82497,7 +82497,7 @@ stage: Added - name: Added7680 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82513,7 +82513,7 @@ stage: Added - name: Added7681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82522,7 +82522,7 @@ stage: Added - name: Modified7682 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82542,7 +82542,7 @@ stage: Modified - name: Added7683 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82558,7 +82558,7 @@ stage: Added - name: Added7684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82567,7 +82567,7 @@ stage: Added - name: Modified7685 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82587,7 +82587,7 @@ stage: Modified - name: Added7686 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82603,7 +82603,7 @@ stage: Added - name: Added7687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82612,7 +82612,7 @@ stage: Added - name: Modified7688 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82632,7 +82632,7 @@ stage: Modified - name: Added7689 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82648,7 +82648,7 @@ stage: Added - name: Added7690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82657,7 +82657,7 @@ stage: Added - name: Modified7691 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82677,7 +82677,7 @@ stage: Modified - name: Added7692 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82693,7 +82693,7 @@ stage: Added - name: Added7693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82702,7 +82702,7 @@ stage: Added - name: Modified7694 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82722,7 +82722,7 @@ stage: Modified - name: Added7695 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82738,7 +82738,7 @@ stage: Added - name: Added7696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82747,7 +82747,7 @@ stage: Added - name: Modified7697 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82767,7 +82767,7 @@ stage: Modified - name: Added7698 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82783,7 +82783,7 @@ stage: Added - name: Added7699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82792,7 +82792,7 @@ stage: Added - name: Modified7700 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82812,7 +82812,7 @@ stage: Modified - name: Added7701 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82828,7 +82828,7 @@ stage: Added - name: Added7702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82837,7 +82837,7 @@ stage: Added - name: Modified7703 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82857,7 +82857,7 @@ stage: Modified - name: Added7704 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3080\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82873,7 +82873,7 @@ stage: Added - name: Added7705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3080\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3080\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82882,7 +82882,7 @@ stage: Added - name: Added7706 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3081\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82898,7 +82898,7 @@ stage: Added - name: Added7707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3081\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3081\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82907,7 +82907,7 @@ stage: Added - name: Added7708 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3082\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82923,7 +82923,7 @@ stage: Added - name: Added7709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3082\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3082\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82932,7 +82932,7 @@ stage: Added - name: Added7710 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3083\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82948,7 +82948,7 @@ stage: Added - name: Added7711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3083\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3083\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82957,7 +82957,7 @@ stage: Added - name: Added7712 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3084\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82973,7 +82973,7 @@ stage: Added - name: Added7713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3084\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3084\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -82982,7 +82982,7 @@ stage: Added - name: Added7714 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3085\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -82998,7 +82998,7 @@ stage: Added - name: Added7715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3085\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3085\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83007,7 +83007,7 @@ stage: Added - name: Added7716 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3086\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83023,7 +83023,7 @@ stage: Added - name: Added7717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3086\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3086\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83032,7 +83032,7 @@ stage: Added - name: Added7718 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3087\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83048,7 +83048,7 @@ stage: Added - name: Added7719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3087\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3087\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83057,7 +83057,7 @@ stage: Added - name: Added7720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769885,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key", "arch": "[x64]", "timestamp": 1606769885, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83065,7 +83065,7 @@ stage: Added - name: Added7721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83074,7 +83074,7 @@ stage: Added - name: Modified7722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83082,7 +83082,7 @@ stage: Modified - name: Added7723 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83090,7 +83090,7 @@ stage: Added - name: Added7724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83099,7 +83099,7 @@ stage: Added - name: Modified7725 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83107,7 +83107,7 @@ stage: Modified - name: Added7726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83115,7 +83115,7 @@ stage: Added - name: Added7727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83124,7 +83124,7 @@ stage: Added - name: Modified7728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83132,7 +83132,7 @@ stage: Modified - name: Added7729 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83140,7 +83140,7 @@ stage: Added - name: Added7730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83149,7 +83149,7 @@ stage: Added - name: Modified7731 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83157,7 +83157,7 @@ stage: Modified - name: Added7732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83165,7 +83165,7 @@ stage: Added - name: Added7733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83174,7 +83174,7 @@ stage: Added - name: Modified7734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83182,7 +83182,7 @@ stage: Modified - name: Added7735 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83190,7 +83190,7 @@ stage: Added - name: Added7736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83199,7 +83199,7 @@ stage: Added - name: Modified7737 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83207,7 +83207,7 @@ stage: Modified - name: Added7738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83215,7 +83215,7 @@ stage: Added - name: Added7739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83224,7 +83224,7 @@ stage: Added - name: Modified7740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83232,7 +83232,7 @@ stage: Modified - name: Added7741 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83240,7 +83240,7 @@ stage: Added - name: Added7742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83249,7 +83249,7 @@ stage: Added - name: Modified7743 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722886,"checksum":"647dc7d8c709ad2479a02608b4c647c0d6992e16"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83257,7 +83257,7 @@ stage: Modified - name: Added7744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83265,7 +83265,7 @@ stage: Added - name: Added7745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83274,7 +83274,7 @@ stage: Added - name: Added7746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83282,7 +83282,7 @@ stage: Added - name: Added7747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83291,7 +83291,7 @@ stage: Added - name: Added7748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83299,7 +83299,7 @@ stage: Added - name: Added7749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83308,7 +83308,7 @@ stage: Added - name: Added7750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83316,7 +83316,7 @@ stage: Added - name: Added7751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83325,7 +83325,7 @@ stage: Added - name: Added7752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83333,7 +83333,7 @@ stage: Added - name: Added7753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83342,7 +83342,7 @@ stage: Added - name: Added7754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83350,7 +83350,7 @@ stage: Added - name: Added7755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83359,7 +83359,7 @@ stage: Added - name: Added7756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83367,7 +83367,7 @@ stage: Added - name: Added7757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83376,7 +83376,7 @@ stage: Added - name: Added7758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -83384,7 +83384,7 @@ stage: Added - name: Added7759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83393,7 +83393,7 @@ stage: Added - name: Added7760 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83409,7 +83409,7 @@ stage: Added - name: Added7761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83418,7 +83418,7 @@ stage: Added - name: Modified7762 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83438,7 +83438,7 @@ stage: Modified - name: Added7763 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83454,7 +83454,7 @@ stage: Added - name: Added7764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83463,7 +83463,7 @@ stage: Added - name: Modified7765 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83483,7 +83483,7 @@ stage: Modified - name: Added7766 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83499,7 +83499,7 @@ stage: Added - name: Added7767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83508,7 +83508,7 @@ stage: Added - name: Modified7768 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83528,7 +83528,7 @@ stage: Modified - name: Added7769 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83544,7 +83544,7 @@ stage: Added - name: Added7770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83553,7 +83553,7 @@ stage: Added - name: Modified7771 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83573,7 +83573,7 @@ stage: Modified - name: Added7772 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83589,7 +83589,7 @@ stage: Added - name: Added7773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83598,7 +83598,7 @@ stage: Added - name: Modified7774 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83618,7 +83618,7 @@ stage: Modified - name: Added7775 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83634,7 +83634,7 @@ stage: Added - name: Added7776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83643,7 +83643,7 @@ stage: Added - name: Modified7777 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83663,7 +83663,7 @@ stage: Modified - name: Added7778 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83679,7 +83679,7 @@ stage: Added - name: Added7779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83688,7 +83688,7 @@ stage: Added - name: Modified7780 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83708,7 +83708,7 @@ stage: Modified - name: Added7781 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83724,7 +83724,7 @@ stage: Added - name: Added7782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83733,7 +83733,7 @@ stage: Added - name: Modified7783 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83753,7 +83753,7 @@ stage: Modified - name: Added7784 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3112\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83768,7 +83768,7 @@ stage: Added - name: Added7785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3112\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3112\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83777,7 +83777,7 @@ stage: Added - name: Added7786 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3113\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83792,7 +83792,7 @@ stage: Added - name: Added7787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3113\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3113\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83801,7 +83801,7 @@ stage: Added - name: Added7788 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3114\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83816,7 +83816,7 @@ stage: Added - name: Added7789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3114\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3114\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83825,7 +83825,7 @@ stage: Added - name: Added7790 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3115\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83840,7 +83840,7 @@ stage: Added - name: Added7791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3115\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3115\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83849,7 +83849,7 @@ stage: Added - name: Added7792 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3116\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83864,7 +83864,7 @@ stage: Added - name: Added7793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3116\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3116\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83873,7 +83873,7 @@ stage: Added - name: Added7794 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3117\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83888,7 +83888,7 @@ stage: Added - name: Added7795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3117\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3117\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83897,7 +83897,7 @@ stage: Added - name: Added7796 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3118\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83912,7 +83912,7 @@ stage: Added - name: Added7797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3118\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3118\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83921,7 +83921,7 @@ stage: Added - name: Added7798 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3119\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -83936,7 +83936,7 @@ stage: Added - name: Added7799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3119\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3119\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83945,7 +83945,7 @@ stage: Added - name: Added7800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -83953,7 +83953,7 @@ stage: Added - name: Added7801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83962,7 +83962,7 @@ stage: Added - name: Modified7802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -83970,7 +83970,7 @@ stage: Modified - name: Added7803 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -83978,7 +83978,7 @@ stage: Added - name: Added7804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -83987,7 +83987,7 @@ stage: Added - name: Modified7805 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -83995,7 +83995,7 @@ stage: Modified - name: Added7806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84003,7 +84003,7 @@ stage: Added - name: Added7807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84012,7 +84012,7 @@ stage: Added - name: Modified7808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84020,7 +84020,7 @@ stage: Modified - name: Added7809 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84028,7 +84028,7 @@ stage: Added - name: Added7810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84037,7 +84037,7 @@ stage: Added - name: Modified7811 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84045,7 +84045,7 @@ stage: Modified - name: Added7812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84053,7 +84053,7 @@ stage: Added - name: Added7813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84062,7 +84062,7 @@ stage: Added - name: Modified7814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84070,7 +84070,7 @@ stage: Modified - name: Added7815 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84078,7 +84078,7 @@ stage: Added - name: Added7816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84087,7 +84087,7 @@ stage: Added - name: Modified7817 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84095,7 +84095,7 @@ stage: Modified - name: Added7818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84103,7 +84103,7 @@ stage: Added - name: Added7819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84112,7 +84112,7 @@ stage: Added - name: Modified7820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84120,7 +84120,7 @@ stage: Modified - name: Added7821 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84128,7 +84128,7 @@ stage: Added - name: Added7822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84137,7 +84137,7 @@ stage: Added - name: Modified7823 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723061, @@ -84145,14 +84145,14 @@ stage: Modified - name: Added7824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84161,14 +84161,14 @@ stage: Added - name: Added7826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84177,14 +84177,14 @@ stage: Added - name: Added7828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84193,14 +84193,14 @@ stage: Added - name: Added7830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84209,14 +84209,14 @@ stage: Added - name: Added7832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84225,14 +84225,14 @@ stage: Added - name: Added7834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84241,14 +84241,14 @@ stage: Added - name: Added7836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84257,14 +84257,14 @@ stage: Added - name: Added7838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added7839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84273,7 +84273,7 @@ stage: Added - name: Added7840 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84289,7 +84289,7 @@ stage: Added - name: Added7841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84298,7 +84298,7 @@ stage: Added - name: Modified7842 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84318,7 +84318,7 @@ stage: Modified - name: Added7843 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84334,7 +84334,7 @@ stage: Added - name: Added7844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84343,7 +84343,7 @@ stage: Added - name: Modified7845 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84363,7 +84363,7 @@ stage: Modified - name: Added7846 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84379,7 +84379,7 @@ stage: Added - name: Added7847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84388,7 +84388,7 @@ stage: Added - name: Modified7848 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84408,7 +84408,7 @@ stage: Modified - name: Added7849 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84424,7 +84424,7 @@ stage: Added - name: Added7850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84433,7 +84433,7 @@ stage: Added - name: Modified7851 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84453,7 +84453,7 @@ stage: Modified - name: Added7852 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84469,7 +84469,7 @@ stage: Added - name: Added7853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84478,7 +84478,7 @@ stage: Added - name: Modified7854 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84498,7 +84498,7 @@ stage: Modified - name: Added7855 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84514,7 +84514,7 @@ stage: Added - name: Added7856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84523,7 +84523,7 @@ stage: Added - name: Modified7857 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84543,7 +84543,7 @@ stage: Modified - name: Added7858 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84559,7 +84559,7 @@ stage: Added - name: Added7859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84568,7 +84568,7 @@ stage: Added - name: Modified7860 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84588,7 +84588,7 @@ stage: Modified - name: Added7861 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84604,7 +84604,7 @@ stage: Added - name: Added7862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84613,7 +84613,7 @@ stage: Added - name: Modified7863 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84633,7 +84633,7 @@ stage: Modified - name: Added7864 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3144\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84649,7 +84649,7 @@ stage: Added - name: Added7865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3144\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3144\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84658,7 +84658,7 @@ stage: Added - name: Added7866 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3145\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84674,7 +84674,7 @@ stage: Added - name: Added7867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3145\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3145\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84683,7 +84683,7 @@ stage: Added - name: Added7868 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3146\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84699,7 +84699,7 @@ stage: Added - name: Added7869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3146\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3146\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84708,7 +84708,7 @@ stage: Added - name: Added7870 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3147\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84724,7 +84724,7 @@ stage: Added - name: Added7871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3147\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3147\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84733,7 +84733,7 @@ stage: Added - name: Added7872 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3148\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84749,7 +84749,7 @@ stage: Added - name: Added7873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3148\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3148\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84758,7 +84758,7 @@ stage: Added - name: Added7874 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3149\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84774,7 +84774,7 @@ stage: Added - name: Added7875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3149\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3149\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84783,7 +84783,7 @@ stage: Added - name: Added7876 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3150\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84799,7 +84799,7 @@ stage: Added - name: Added7877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3150\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3150\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84808,7 +84808,7 @@ stage: Added - name: Added7878 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3151\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -84824,7 +84824,7 @@ stage: Added - name: Added7879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3151\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3151\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84833,7 +84833,7 @@ stage: Added - name: Added7880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84841,7 +84841,7 @@ stage: Added - name: Added7881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84850,7 +84850,7 @@ stage: Added - name: Modified7882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84858,7 +84858,7 @@ stage: Modified - name: Added7883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84866,7 +84866,7 @@ stage: Added - name: Added7884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84875,7 +84875,7 @@ stage: Added - name: Modified7885 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84883,7 +84883,7 @@ stage: Modified - name: Added7886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84891,7 +84891,7 @@ stage: Added - name: Added7887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84900,7 +84900,7 @@ stage: Added - name: Modified7888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84908,7 +84908,7 @@ stage: Modified - name: Added7889 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84916,7 +84916,7 @@ stage: Added - name: Added7890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84925,7 +84925,7 @@ stage: Added - name: Modified7891 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84933,7 +84933,7 @@ stage: Modified - name: Added7892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84941,7 +84941,7 @@ stage: Added - name: Added7893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84950,7 +84950,7 @@ stage: Added - name: Modified7894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84958,7 +84958,7 @@ stage: Modified - name: Added7895 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84966,7 +84966,7 @@ stage: Added - name: Added7896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -84975,7 +84975,7 @@ stage: Added - name: Modified7897 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84983,7 +84983,7 @@ stage: Modified - name: Added7898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -84991,7 +84991,7 @@ stage: Added - name: Added7899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85000,7 +85000,7 @@ stage: Added - name: Modified7900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -85008,7 +85008,7 @@ stage: Modified - name: Added7901 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -85016,7 +85016,7 @@ stage: Added - name: Added7902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85025,7 +85025,7 @@ stage: Added - name: Modified7903 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -85033,7 +85033,7 @@ stage: Modified - name: Added7904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3160\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3160\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -85041,7 +85041,7 @@ stage: Added - name: Added7905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3160\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3160\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85050,7 +85050,7 @@ stage: Added - name: Added7906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3161\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3161\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -85058,7 +85058,7 @@ stage: Added - name: Added7907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3161\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3161\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85067,7 +85067,7 @@ stage: Added - name: Added7908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3162\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3162\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -85075,7 +85075,7 @@ stage: Added - name: Added7909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3162\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3162\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85084,7 +85084,7 @@ stage: Added - name: Added7910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3163\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3163\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -85092,7 +85092,7 @@ stage: Added - name: Added7911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3163\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3163\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85101,7 +85101,7 @@ stage: Added - name: Added7912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3164\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3164\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -85109,7 +85109,7 @@ stage: Added - name: Added7913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3164\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3164\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85118,7 +85118,7 @@ stage: Added - name: Added7914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3165\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3165\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -85126,7 +85126,7 @@ stage: Added - name: Added7915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3165\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3165\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85135,7 +85135,7 @@ stage: Added - name: Added7916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3166\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3166\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -85143,7 +85143,7 @@ stage: Added - name: Added7917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3166\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3166\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85152,7 +85152,7 @@ stage: Added - name: Added7918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3167\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3167\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -85160,7 +85160,7 @@ stage: Added - name: Added7919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3167\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3167\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85169,7 +85169,7 @@ stage: Added - name: Added7920 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85184,7 +85184,7 @@ stage: Added - name: Added7921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85193,7 +85193,7 @@ stage: Added - name: Modified7922 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85212,7 +85212,7 @@ stage: Modified - name: Added7923 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85227,7 +85227,7 @@ stage: Added - name: Added7924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85236,7 +85236,7 @@ stage: Added - name: Modified7925 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85255,7 +85255,7 @@ stage: Modified - name: Added7926 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85270,7 +85270,7 @@ stage: Added - name: Added7927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85279,7 +85279,7 @@ stage: Added - name: Modified7928 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85298,7 +85298,7 @@ stage: Modified - name: Added7929 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85313,7 +85313,7 @@ stage: Added - name: Added7930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85322,7 +85322,7 @@ stage: Added - name: Modified7931 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85341,7 +85341,7 @@ stage: Modified - name: Added7932 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85356,7 +85356,7 @@ stage: Added - name: Added7933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85365,7 +85365,7 @@ stage: Added - name: Modified7934 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85384,7 +85384,7 @@ stage: Modified - name: Added7935 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85399,7 +85399,7 @@ stage: Added - name: Added7936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85408,7 +85408,7 @@ stage: Added - name: Modified7937 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85427,7 +85427,7 @@ stage: Modified - name: Added7938 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85442,7 +85442,7 @@ stage: Added - name: Added7939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85451,7 +85451,7 @@ stage: Added - name: Modified7940 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85470,7 +85470,7 @@ stage: Modified - name: Added7941 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85485,7 +85485,7 @@ stage: Added - name: Added7942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85494,7 +85494,7 @@ stage: Added - name: Modified7943 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85513,7 +85513,7 @@ stage: Modified - name: Added7944 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3176\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85528,7 +85528,7 @@ stage: Added - name: Added7945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3176\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3176\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85537,7 +85537,7 @@ stage: Added - name: Added7946 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3177\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85552,7 +85552,7 @@ stage: Added - name: Added7947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3177\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3177\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85561,7 +85561,7 @@ stage: Added - name: Added7948 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3178\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85576,7 +85576,7 @@ stage: Added - name: Added7949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3178\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3178\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85585,7 +85585,7 @@ stage: Added - name: Added7950 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3179\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85600,7 +85600,7 @@ stage: Added - name: Added7951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3179\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3179\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85609,7 +85609,7 @@ stage: Added - name: Added7952 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3180\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85624,7 +85624,7 @@ stage: Added - name: Added7953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3180\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3180\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85633,7 +85633,7 @@ stage: Added - name: Added7954 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3181\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85648,7 +85648,7 @@ stage: Added - name: Added7955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3181\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3181\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85657,7 +85657,7 @@ stage: Added - name: Added7956 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3182\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85672,7 +85672,7 @@ stage: Added - name: Added7957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3182\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3182\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85681,7 +85681,7 @@ stage: Added - name: Added7958 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3183\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -85696,7 +85696,7 @@ stage: Added - name: Added7959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3183\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3183\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85705,14 +85705,14 @@ stage: Added - name: Added7960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added7961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85721,21 +85721,21 @@ stage: Added - name: Modified7962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added7963 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added7964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85744,21 +85744,21 @@ stage: Added - name: Modified7965 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added7966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added7967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85767,21 +85767,21 @@ stage: Added - name: Modified7968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added7969 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added7970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85790,21 +85790,21 @@ stage: Added - name: Modified7971 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added7972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added7973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85813,21 +85813,21 @@ stage: Added - name: Modified7974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added7975 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added7976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85836,21 +85836,21 @@ stage: Added - name: Modified7977 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added7978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added7979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85859,21 +85859,21 @@ stage: Added - name: Modified7980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added7981 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added7982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85882,21 +85882,21 @@ stage: Added - name: Modified7983 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added7984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3192\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3192\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3192\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3192\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85905,14 +85905,14 @@ stage: Added - name: Added7986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3193\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3193\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3193\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3193\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85921,14 +85921,14 @@ stage: Added - name: Added7988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3194\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3194\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3194\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3194\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85937,14 +85937,14 @@ stage: Added - name: Added7990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3195\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3195\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3195\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3195\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85953,14 +85953,14 @@ stage: Added - name: Added7992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3196\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3196\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3196\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3196\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85969,14 +85969,14 @@ stage: Added - name: Added7994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3197\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3197\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3197\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3197\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -85985,14 +85985,14 @@ stage: Added - name: Added7996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3198\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3198\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3198\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3198\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86001,14 +86001,14 @@ stage: Added - name: Added7998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3199\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3199\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added7999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3199\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3199\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86017,7 +86017,7 @@ stage: Added - name: Added8000 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86033,7 +86033,7 @@ stage: Added - name: Added8001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86042,7 +86042,7 @@ stage: Added - name: Modified8002 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86062,7 +86062,7 @@ stage: Modified - name: Added8003 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86078,7 +86078,7 @@ stage: Added - name: Added8004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86087,7 +86087,7 @@ stage: Added - name: Modified8005 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86107,7 +86107,7 @@ stage: Modified - name: Added8006 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86123,7 +86123,7 @@ stage: Added - name: Added8007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86132,7 +86132,7 @@ stage: Added - name: Modified8008 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86152,7 +86152,7 @@ stage: Modified - name: Added8009 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86168,7 +86168,7 @@ stage: Added - name: Added8010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86177,7 +86177,7 @@ stage: Added - name: Modified8011 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86197,7 +86197,7 @@ stage: Modified - name: Added8012 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86213,7 +86213,7 @@ stage: Added - name: Added8013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86222,7 +86222,7 @@ stage: Added - name: Modified8014 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86242,7 +86242,7 @@ stage: Modified - name: Added8015 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86258,7 +86258,7 @@ stage: Added - name: Added8016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86267,7 +86267,7 @@ stage: Added - name: Modified8017 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86287,7 +86287,7 @@ stage: Modified - name: Added8018 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86303,7 +86303,7 @@ stage: Added - name: Added8019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86312,7 +86312,7 @@ stage: Added - name: Modified8020 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86332,7 +86332,7 @@ stage: Modified - name: Added8021 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86348,7 +86348,7 @@ stage: Added - name: Added8022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86357,7 +86357,7 @@ stage: Added - name: Modified8023 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86377,7 +86377,7 @@ stage: Modified - name: Added8024 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3208\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86393,7 +86393,7 @@ stage: Added - name: Added8025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3208\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3208\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86402,7 +86402,7 @@ stage: Added - name: Added8026 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3209\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86418,7 +86418,7 @@ stage: Added - name: Added8027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3209\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3209\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86427,7 +86427,7 @@ stage: Added - name: Added8028 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3210\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86443,7 +86443,7 @@ stage: Added - name: Added8029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3210\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3210\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86452,7 +86452,7 @@ stage: Added - name: Added8030 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3211\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86468,7 +86468,7 @@ stage: Added - name: Added8031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3211\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3211\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86477,7 +86477,7 @@ stage: Added - name: Added8032 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3212\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86493,7 +86493,7 @@ stage: Added - name: Added8033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3212\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3212\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86502,7 +86502,7 @@ stage: Added - name: Added8034 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3213\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86518,7 +86518,7 @@ stage: Added - name: Added8035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3213\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3213\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86527,7 +86527,7 @@ stage: Added - name: Added8036 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3214\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86543,7 +86543,7 @@ stage: Added - name: Added8037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3214\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3214\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86552,7 +86552,7 @@ stage: Added - name: Added8038 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3215\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86568,7 +86568,7 @@ stage: Added - name: Added8039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3215\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3215\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86577,7 +86577,7 @@ stage: Added - name: Added8040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86585,7 +86585,7 @@ stage: Added - name: Added8041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86594,7 +86594,7 @@ stage: Added - name: Modified8042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86602,7 +86602,7 @@ stage: Modified - name: Added8043 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86610,7 +86610,7 @@ stage: Added - name: Added8044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86619,7 +86619,7 @@ stage: Added - name: Modified8045 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86627,7 +86627,7 @@ stage: Modified - name: Added8046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86635,7 +86635,7 @@ stage: Added - name: Added8047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86644,7 +86644,7 @@ stage: Added - name: Modified8048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86652,7 +86652,7 @@ stage: Modified - name: Added8049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86660,7 +86660,7 @@ stage: Added - name: Added8050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86669,7 +86669,7 @@ stage: Added - name: Modified8051 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86677,7 +86677,7 @@ stage: Modified - name: Added8052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86685,7 +86685,7 @@ stage: Added - name: Added8053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86694,7 +86694,7 @@ stage: Added - name: Modified8054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86702,7 +86702,7 @@ stage: Modified - name: Added8055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86710,7 +86710,7 @@ stage: Added - name: Added8056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86719,7 +86719,7 @@ stage: Added - name: Modified8057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86727,7 +86727,7 @@ stage: Modified - name: Added8058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86735,7 +86735,7 @@ stage: Added - name: Added8059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86744,7 +86744,7 @@ stage: Added - name: Modified8060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86752,7 +86752,7 @@ stage: Modified - name: Added8061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86760,7 +86760,7 @@ stage: Added - name: Added8062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86769,7 +86769,7 @@ stage: Added - name: Modified8063 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86777,7 +86777,7 @@ stage: Modified - name: Added8064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86785,7 +86785,7 @@ stage: Added - name: Added8065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86794,7 +86794,7 @@ stage: Added - name: Added8066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86802,7 +86802,7 @@ stage: Added - name: Added8067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86811,7 +86811,7 @@ stage: Added - name: Added8068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86819,7 +86819,7 @@ stage: Added - name: Added8069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86828,7 +86828,7 @@ stage: Added - name: Added8070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86836,7 +86836,7 @@ stage: Added - name: Added8071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86845,7 +86845,7 @@ stage: Added - name: Added8072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86853,7 +86853,7 @@ stage: Added - name: Added8073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86862,7 +86862,7 @@ stage: Added - name: Added8074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86870,7 +86870,7 @@ stage: Added - name: Added8075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86879,7 +86879,7 @@ stage: Added - name: Added8076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86887,7 +86887,7 @@ stage: Added - name: Added8077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86896,7 +86896,7 @@ stage: Added - name: Added8078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -86904,7 +86904,7 @@ stage: Added - name: Added8079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -86913,7 +86913,7 @@ stage: Added - name: Added8080 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86929,7 +86929,7 @@ stage: Added - name: Added8081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86938,7 +86938,7 @@ stage: Added - name: Modified8082 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86958,7 +86958,7 @@ stage: Modified - name: Added8083 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -86974,7 +86974,7 @@ stage: Added - name: Added8084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -86983,7 +86983,7 @@ stage: Added - name: Modified8085 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87003,7 +87003,7 @@ stage: Modified - name: Added8086 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87019,7 +87019,7 @@ stage: Added - name: Added0 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87028,7 +87028,7 @@ stage: Added - name: Modified1 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87048,7 +87048,7 @@ stage: Modified - name: Added2 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87064,7 +87064,7 @@ stage: Added - name: Added3 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87073,7 +87073,7 @@ stage: Added - name: Modified4 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87093,7 +87093,7 @@ stage: Modified - name: Added5 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87109,7 +87109,7 @@ stage: Added - name: Added6 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87118,7 +87118,7 @@ stage: Added - name: Modified7 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87138,7 +87138,7 @@ stage: Modified - name: Added8 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87154,7 +87154,7 @@ stage: Added - name: Added9 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87163,7 +87163,7 @@ stage: Added - name: Modified10 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87183,7 +87183,7 @@ stage: Modified - name: Added11 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87199,7 +87199,7 @@ stage: Added - name: Added12 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87208,7 +87208,7 @@ stage: Added - name: Modified13 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87228,7 +87228,7 @@ stage: Modified - name: Added14 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87244,7 +87244,7 @@ stage: Added - name: Added15 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87253,7 +87253,7 @@ stage: Added - name: Modified16 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87273,7 +87273,7 @@ stage: Modified - name: Added17 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3240\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87288,7 +87288,7 @@ stage: Added - name: Added18 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3240\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3240\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87297,7 +87297,7 @@ stage: Added - name: Added19 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3241\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87312,7 +87312,7 @@ stage: Added - name: Added20 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3241\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3241\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87321,7 +87321,7 @@ stage: Added - name: Added21 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3242\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87336,7 +87336,7 @@ stage: Added - name: Added22 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3242\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3242\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87345,7 +87345,7 @@ stage: Added - name: Added23 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3243\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87360,7 +87360,7 @@ stage: Added - name: Added24 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3243\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3243\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87369,7 +87369,7 @@ stage: Added - name: Added25 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3244\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87384,7 +87384,7 @@ stage: Added - name: Added26 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3244\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3244\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87393,7 +87393,7 @@ stage: Added - name: Added27 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3245\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87408,7 +87408,7 @@ stage: Added - name: Added28 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3245\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3245\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87417,7 +87417,7 @@ stage: Added - name: Added29 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3246\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87432,7 +87432,7 @@ stage: Added - name: Added30 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3246\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3246\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87441,7 +87441,7 @@ stage: Added - name: Added31 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3247\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87456,7 +87456,7 @@ stage: Added - name: Added32 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3247\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3247\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87465,7 +87465,7 @@ stage: Added - name: Added33 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87473,7 +87473,7 @@ stage: Added - name: Added34 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87482,7 +87482,7 @@ stage: Added - name: Modified35 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87490,7 +87490,7 @@ stage: Modified - name: Added36 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87498,7 +87498,7 @@ stage: Added - name: Added37 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87507,7 +87507,7 @@ stage: Added - name: Modified38 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87515,7 +87515,7 @@ stage: Modified - name: Added39 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87523,7 +87523,7 @@ stage: Added - name: Added40 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87532,7 +87532,7 @@ stage: Added - name: Modified41 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87540,7 +87540,7 @@ stage: Modified - name: Added42 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87548,7 +87548,7 @@ stage: Added - name: Added43 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87557,7 +87557,7 @@ stage: Added - name: Modified44 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87565,7 +87565,7 @@ stage: Modified - name: Added45 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87573,7 +87573,7 @@ stage: Added - name: Added46 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87582,7 +87582,7 @@ stage: Added - name: Modified47 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87590,7 +87590,7 @@ stage: Modified - name: Added48 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87598,7 +87598,7 @@ stage: Added - name: Added49 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87607,7 +87607,7 @@ stage: Added - name: Modified50 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87615,7 +87615,7 @@ stage: Modified - name: Added51 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87623,7 +87623,7 @@ stage: Added - name: Added52 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87632,7 +87632,7 @@ stage: Added - name: Modified53 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87640,7 +87640,7 @@ stage: Modified - name: Added54 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87648,7 +87648,7 @@ stage: Added - name: Added55 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87657,7 +87657,7 @@ stage: Added - name: Modified56 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723062, @@ -87665,14 +87665,14 @@ stage: Modified - name: Added57 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added58 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87681,14 +87681,14 @@ stage: Added - name: Added59 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added60 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87697,14 +87697,14 @@ stage: Added - name: Added61 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added62 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87713,14 +87713,14 @@ stage: Added - name: Added63 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added64 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87729,14 +87729,14 @@ stage: Added - name: Added65 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added66 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87745,14 +87745,14 @@ stage: Added - name: Added67 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added68 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87761,14 +87761,14 @@ stage: Added - name: Added69 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added70 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87777,14 +87777,14 @@ stage: Added - name: Added71 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key", "arch": "[x64]", "timestamp": 1606769886, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added72 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87793,7 +87793,7 @@ stage: Added - name: Added73 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769886,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87809,7 +87809,7 @@ stage: Added - name: Added74 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87818,7 +87818,7 @@ stage: Added - name: Modified75 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87838,7 +87838,7 @@ stage: Modified - name: Added76 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87854,7 +87854,7 @@ stage: Added - name: Added77 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87863,7 +87863,7 @@ stage: Added - name: Modified78 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87883,7 +87883,7 @@ stage: Modified - name: Added79 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87899,7 +87899,7 @@ stage: Added - name: Added80 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87908,7 +87908,7 @@ stage: Added - name: Modified81 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87928,7 +87928,7 @@ stage: Modified - name: Added82 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87944,7 +87944,7 @@ stage: Added - name: Added83 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -87953,7 +87953,7 @@ stage: Added - name: Modified84 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87973,7 +87973,7 @@ stage: Modified - name: Added85 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -87989,7 +87989,7 @@ stage: Added - name: Added86 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -87998,7 +87998,7 @@ stage: Added - name: Modified87 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88018,7 +88018,7 @@ stage: Modified - name: Added88 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88034,7 +88034,7 @@ stage: Added - name: Added89 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88043,7 +88043,7 @@ stage: Added - name: Modified90 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88063,7 +88063,7 @@ stage: Modified - name: Added91 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88079,7 +88079,7 @@ stage: Added - name: Added92 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88088,7 +88088,7 @@ stage: Added - name: Modified93 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88108,7 +88108,7 @@ stage: Modified - name: Added94 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88124,7 +88124,7 @@ stage: Added - name: Added95 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88133,7 +88133,7 @@ stage: Added - name: Modified96 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88153,7 +88153,7 @@ stage: Modified - name: Added97 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3272\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88169,7 +88169,7 @@ stage: Added - name: Added98 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3272\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3272\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88178,7 +88178,7 @@ stage: Added - name: Added99 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3273\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88194,7 +88194,7 @@ stage: Added - name: Added100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3273\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3273\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88203,7 +88203,7 @@ stage: Added - name: Added101 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3274\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88219,7 +88219,7 @@ stage: Added - name: Added102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3274\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3274\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88228,7 +88228,7 @@ stage: Added - name: Added103 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3275\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88244,7 +88244,7 @@ stage: Added - name: Added104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3275\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3275\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88253,7 +88253,7 @@ stage: Added - name: Added105 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3276\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88269,7 +88269,7 @@ stage: Added - name: Added106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3276\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3276\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88278,7 +88278,7 @@ stage: Added - name: Added107 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3277\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88294,7 +88294,7 @@ stage: Added - name: Added108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3277\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3277\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88303,7 +88303,7 @@ stage: Added - name: Added109 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3278\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88319,7 +88319,7 @@ stage: Added - name: Added110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3278\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3278\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88328,7 +88328,7 @@ stage: Added - name: Added111 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3279\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88344,7 +88344,7 @@ stage: Added - name: Added112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3279\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3279\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88353,7 +88353,7 @@ stage: Added - name: Added113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88361,7 +88361,7 @@ stage: Added - name: Added114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88370,7 +88370,7 @@ stage: Added - name: Modified115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88378,7 +88378,7 @@ stage: Modified - name: Added116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88386,7 +88386,7 @@ stage: Added - name: Added117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88395,7 +88395,7 @@ stage: Added - name: Modified118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88403,7 +88403,7 @@ stage: Modified - name: Added119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88411,7 +88411,7 @@ stage: Added - name: Added120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88420,7 +88420,7 @@ stage: Added - name: Modified121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88428,7 +88428,7 @@ stage: Modified - name: Added122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88436,7 +88436,7 @@ stage: Added - name: Added123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88445,7 +88445,7 @@ stage: Added - name: Modified124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88453,7 +88453,7 @@ stage: Modified - name: Added125 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88461,7 +88461,7 @@ stage: Added - name: Added126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88470,7 +88470,7 @@ stage: Added - name: Modified127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88478,7 +88478,7 @@ stage: Modified - name: Added128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88486,7 +88486,7 @@ stage: Added - name: Added129 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88495,7 +88495,7 @@ stage: Added - name: Modified130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88503,7 +88503,7 @@ stage: Modified - name: Added131 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88511,7 +88511,7 @@ stage: Added - name: Added132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88520,7 +88520,7 @@ stage: Added - name: Modified133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88528,7 +88528,7 @@ stage: Modified - name: Added134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88536,7 +88536,7 @@ stage: Added - name: Added135 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88545,7 +88545,7 @@ stage: Added - name: Modified136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -88553,7 +88553,7 @@ stage: Modified - name: Added137 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3288\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3288\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -88561,7 +88561,7 @@ stage: Added - name: Added138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3288\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3288\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88570,7 +88570,7 @@ stage: Added - name: Added139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3289\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3289\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -88578,7 +88578,7 @@ stage: Added - name: Added140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3289\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3289\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88587,7 +88587,7 @@ stage: Added - name: Added141 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3290\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3290\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -88595,7 +88595,7 @@ stage: Added - name: Added142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3290\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3290\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88604,7 +88604,7 @@ stage: Added - name: Added143 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3291\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3291\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -88612,7 +88612,7 @@ stage: Added - name: Added144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3291\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3291\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88621,7 +88621,7 @@ stage: Added - name: Added145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3292\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3292\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -88629,7 +88629,7 @@ stage: Added - name: Added146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3292\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3292\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88638,7 +88638,7 @@ stage: Added - name: Added147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3293\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3293\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -88646,7 +88646,7 @@ stage: Added - name: Added148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3293\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3293\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88655,7 +88655,7 @@ stage: Added - name: Added149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3294\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3294\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -88663,7 +88663,7 @@ stage: Added - name: Added150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3294\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3294\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88672,7 +88672,7 @@ stage: Added - name: Added151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3295\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3295\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -88680,7 +88680,7 @@ stage: Added - name: Added152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3295\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3295\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88689,7 +88689,7 @@ stage: Added - name: Added153 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88704,7 +88704,7 @@ stage: Added - name: Added154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88713,7 +88713,7 @@ stage: Added - name: Modified155 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88732,7 +88732,7 @@ stage: Modified - name: Added156 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88747,7 +88747,7 @@ stage: Added - name: Added157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88756,7 +88756,7 @@ stage: Added - name: Modified158 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88775,7 +88775,7 @@ stage: Modified - name: Added159 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88790,7 +88790,7 @@ stage: Added - name: Added160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88799,7 +88799,7 @@ stage: Added - name: Modified161 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88818,7 +88818,7 @@ stage: Modified - name: Added162 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88833,7 +88833,7 @@ stage: Added - name: Added163 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -88842,7 +88842,7 @@ stage: Added - name: Modified164 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88861,7 +88861,7 @@ stage: Modified - name: Added165 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88876,7 +88876,7 @@ stage: Added - name: Added166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88885,7 +88885,7 @@ stage: Added - name: Modified167 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88904,7 +88904,7 @@ stage: Modified - name: Added168 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88919,7 +88919,7 @@ stage: Added - name: Added169 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88928,7 +88928,7 @@ stage: Added - name: Modified170 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88947,7 +88947,7 @@ stage: Modified - name: Added171 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88962,7 +88962,7 @@ stage: Added - name: Added172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -88971,7 +88971,7 @@ stage: Added - name: Modified173 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -88990,7 +88990,7 @@ stage: Modified - name: Added174 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89005,7 +89005,7 @@ stage: Added - name: Added175 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89014,7 +89014,7 @@ stage: Added - name: Modified176 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89033,7 +89033,7 @@ stage: Modified - name: Added177 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3304\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89048,7 +89048,7 @@ stage: Added - name: Added178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3304\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3304\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89057,7 +89057,7 @@ stage: Added - name: Added179 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3305\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89072,7 +89072,7 @@ stage: Added - name: Added180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3305\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3305\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89081,7 +89081,7 @@ stage: Added - name: Added181 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3306\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89096,7 +89096,7 @@ stage: Added - name: Added182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3306\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3306\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89105,7 +89105,7 @@ stage: Added - name: Added183 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3307\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89120,7 +89120,7 @@ stage: Added - name: Added184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3307\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3307\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89129,7 +89129,7 @@ stage: Added - name: Added185 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3308\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89144,7 +89144,7 @@ stage: Added - name: Added186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3308\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3308\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89153,7 +89153,7 @@ stage: Added - name: Added187 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3309\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89168,7 +89168,7 @@ stage: Added - name: Added188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3309\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3309\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89177,7 +89177,7 @@ stage: Added - name: Added189 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3310\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89192,7 +89192,7 @@ stage: Added - name: Added190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3310\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3310\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89201,7 +89201,7 @@ stage: Added - name: Added191 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3311\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89216,14 +89216,14 @@ stage: Added - name: Added192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89232,21 +89232,21 @@ stage: Added - name: Modified194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89255,21 +89255,21 @@ stage: Added - name: Modified197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89278,21 +89278,21 @@ stage: Added - name: Modified200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89301,7 +89301,7 @@ stage: Added - name: Added203 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3311\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3311\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89310,21 +89310,21 @@ stage: Added - name: Modified204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added205 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89333,21 +89333,21 @@ stage: Added - name: Modified207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added209 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89356,21 +89356,21 @@ stage: Added - name: Modified210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added211 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89379,21 +89379,21 @@ stage: Added - name: Modified213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Added214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3320\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3320\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added215 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3320\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3320\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89402,14 +89402,14 @@ stage: Added - name: Added216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3321\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3321\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added217 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3321\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3321\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89418,14 +89418,14 @@ stage: Added - name: Added218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3322\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3322\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3322\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3322\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89434,14 +89434,14 @@ stage: Added - name: Added220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3323\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3323\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added221 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3323\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3323\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89450,14 +89450,14 @@ stage: Added - name: Added222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3324\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3324\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added223 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3324\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3324\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89466,14 +89466,14 @@ stage: Added - name: Added224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3325\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3325\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3325\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3325\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89482,14 +89482,14 @@ stage: Added - name: Added226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3326\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3326\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3326\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3326\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89498,14 +89498,14 @@ stage: Added - name: Added228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3327\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3327\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3327\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3327\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -89514,7 +89514,7 @@ stage: Added - name: Added230 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89530,7 +89530,7 @@ stage: Added - name: Added231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89538,7 +89538,7 @@ stage: Added - name: Modified232 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89558,7 +89558,7 @@ stage: Modified - name: Added233 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89574,7 +89574,7 @@ stage: Added - name: Added234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89582,7 +89582,7 @@ stage: Added - name: Modified235 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89602,7 +89602,7 @@ stage: Modified - name: Added236 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89618,7 +89618,7 @@ stage: Added - name: Added237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89626,7 +89626,7 @@ stage: Added - name: Modified238 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89646,7 +89646,7 @@ stage: Modified - name: Added239 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89662,7 +89662,7 @@ stage: Added - name: Added240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89670,7 +89670,7 @@ stage: Added - name: Modified241 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89690,7 +89690,7 @@ stage: Modified - name: Added242 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89706,7 +89706,7 @@ stage: Added - name: Added243 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89714,7 +89714,7 @@ stage: Added - name: Modified244 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89734,7 +89734,7 @@ stage: Modified - name: Added245 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89750,7 +89750,7 @@ stage: Added - name: Added246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89758,7 +89758,7 @@ stage: Added - name: Modified247 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89778,7 +89778,7 @@ stage: Modified - name: Added248 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89794,7 +89794,7 @@ stage: Added - name: Added249 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89802,7 +89802,7 @@ stage: Added - name: Modified250 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89822,7 +89822,7 @@ stage: Modified - name: Added251 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89838,7 +89838,7 @@ stage: Added - name: Added252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89846,7 +89846,7 @@ stage: Added - name: Modified253 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89866,7 +89866,7 @@ stage: Modified - name: Added254 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3336\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89882,7 +89882,7 @@ stage: Added - name: Added255 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3336\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3336\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89890,7 +89890,7 @@ stage: Added - name: Added256 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3337\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89906,7 +89906,7 @@ stage: Added - name: Added257 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3337\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3337\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89914,7 +89914,7 @@ stage: Added - name: Added258 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3338\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89930,7 +89930,7 @@ stage: Added - name: Added259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3338\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3338\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89938,7 +89938,7 @@ stage: Added - name: Added260 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3339\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89954,7 +89954,7 @@ stage: Added - name: Added261 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3339\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3339\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89962,7 +89962,7 @@ stage: Added - name: Added262 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3340\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -89978,7 +89978,7 @@ stage: Added - name: Added263 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3340\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3340\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -89986,7 +89986,7 @@ stage: Added - name: Added264 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3341\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90002,7 +90002,7 @@ stage: Added - name: Added265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3341\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3341\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90010,7 +90010,7 @@ stage: Added - name: Added266 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3342\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90026,7 +90026,7 @@ stage: Added - name: Added267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3342\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3342\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90034,7 +90034,7 @@ stage: Added - name: Added268 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3343\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90050,7 +90050,7 @@ stage: Added - name: Added269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3343\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3343\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90058,7 +90058,7 @@ stage: Added - name: Added270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90066,7 +90066,7 @@ stage: Added - name: Added271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90074,7 +90074,7 @@ stage: Added - name: Modified272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90082,7 +90082,7 @@ stage: Modified - name: Added273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90090,7 +90090,7 @@ stage: Added - name: Added274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90098,7 +90098,7 @@ stage: Added - name: Modified275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90106,7 +90106,7 @@ stage: Modified - name: Added276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90114,7 +90114,7 @@ stage: Added - name: Added277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90122,7 +90122,7 @@ stage: Added - name: Modified278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90130,7 +90130,7 @@ stage: Modified - name: Added279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90138,7 +90138,7 @@ stage: Added - name: Added280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90146,7 +90146,7 @@ stage: Added - name: Modified281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90154,7 +90154,7 @@ stage: Modified - name: Added282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90162,7 +90162,7 @@ stage: Added - name: Added283 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90170,7 +90170,7 @@ stage: Added - name: Modified284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90178,7 +90178,7 @@ stage: Modified - name: Added285 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90186,7 +90186,7 @@ stage: Added - name: Added286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90194,7 +90194,7 @@ stage: Added - name: Modified287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90202,7 +90202,7 @@ stage: Modified - name: Added288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90210,7 +90210,7 @@ stage: Added - name: Added289 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90218,7 +90218,7 @@ stage: Added - name: Modified290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90226,7 +90226,7 @@ stage: Modified - name: Added291 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90234,7 +90234,7 @@ stage: Added - name: Added292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90242,7 +90242,7 @@ stage: Added - name: Modified293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90250,7 +90250,7 @@ stage: Modified - name: Added294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90258,7 +90258,7 @@ stage: Added - name: Added295 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90266,7 +90266,7 @@ stage: Added - name: Added296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90274,7 +90274,7 @@ stage: Added - name: Added297 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90282,7 +90282,7 @@ stage: Added - name: Added298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90290,7 +90290,7 @@ stage: Added - name: Added299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90298,7 +90298,7 @@ stage: Added - name: Added300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90306,7 +90306,7 @@ stage: Added - name: Added301 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90314,7 +90314,7 @@ stage: Added - name: Added302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90322,7 +90322,7 @@ stage: Added - name: Added303 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90330,7 +90330,7 @@ stage: Added - name: Added304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90338,7 +90338,7 @@ stage: Added - name: Added305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90346,7 +90346,7 @@ stage: Added - name: Added306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90354,7 +90354,7 @@ stage: Added - name: Added307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90362,7 +90362,7 @@ stage: Added - name: Added308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -90370,7 +90370,7 @@ stage: Added - name: Added309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90378,7 +90378,7 @@ stage: Added - name: Added310 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90394,14 +90394,14 @@ stage: Added - name: Modified311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Modified - name: Modified312 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90421,7 +90421,7 @@ stage: Modified - name: Added313 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90437,7 +90437,7 @@ stage: Added - name: Added314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90445,7 +90445,7 @@ stage: Added - name: Modified315 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90465,7 +90465,7 @@ stage: Modified - name: Added316 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90481,7 +90481,7 @@ stage: Added - name: Added317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90489,7 +90489,7 @@ stage: Added - name: Modified318 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90509,7 +90509,7 @@ stage: Modified - name: Added319 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90525,7 +90525,7 @@ stage: Added - name: Added320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90533,7 +90533,7 @@ stage: Added - name: Modified321 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90553,7 +90553,7 @@ stage: Modified - name: Added322 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90569,7 +90569,7 @@ stage: Added - name: Added323 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90577,7 +90577,7 @@ stage: Added - name: Modified324 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90597,7 +90597,7 @@ stage: Modified - name: Added325 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90613,7 +90613,7 @@ stage: Added - name: Added326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90621,7 +90621,7 @@ stage: Added - name: Modified327 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90641,7 +90641,7 @@ stage: Modified - name: Added328 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90657,7 +90657,7 @@ stage: Added - name: Added329 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90665,7 +90665,7 @@ stage: Added - name: Modified330 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90685,7 +90685,7 @@ stage: Modified - name: Added331 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90701,7 +90701,7 @@ stage: Added - name: Added332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90709,7 +90709,7 @@ stage: Added - name: Modified333 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90729,7 +90729,7 @@ stage: Modified - name: Added334 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3368\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90744,7 +90744,7 @@ stage: Added - name: Added335 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3368\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3368\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90752,7 +90752,7 @@ stage: Added - name: Added336 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3369\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90767,7 +90767,7 @@ stage: Added - name: Added337 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3369\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3369\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90775,7 +90775,7 @@ stage: Added - name: Added338 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3370\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90790,7 +90790,7 @@ stage: Added - name: Added339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3370\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3370\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90798,7 +90798,7 @@ stage: Added - name: Added340 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3371\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90813,7 +90813,7 @@ stage: Added - name: Added341 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3371\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3371\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90821,7 +90821,7 @@ stage: Added - name: Added342 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3372\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90836,7 +90836,7 @@ stage: Added - name: Added343 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3372\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3372\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90844,7 +90844,7 @@ stage: Added - name: Added344 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3373\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90859,7 +90859,7 @@ stage: Added - name: Added345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3373\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3373\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90867,7 +90867,7 @@ stage: Added - name: Added346 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3374\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90882,7 +90882,7 @@ stage: Added - name: Added347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3374\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3374\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90890,7 +90890,7 @@ stage: Added - name: Added348 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3375\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -90905,7 +90905,7 @@ stage: Added - name: Added349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3375\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3375\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90913,7 +90913,7 @@ stage: Added - name: Added350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -90921,7 +90921,7 @@ stage: Added - name: Added351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90929,7 +90929,7 @@ stage: Added - name: Modified352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -90937,7 +90937,7 @@ stage: Modified - name: Added353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -90945,7 +90945,7 @@ stage: Added - name: Added354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90953,7 +90953,7 @@ stage: Added - name: Modified355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -90961,7 +90961,7 @@ stage: Modified - name: Added356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -90969,7 +90969,7 @@ stage: Added - name: Added357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -90977,7 +90977,7 @@ stage: Added - name: Modified358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -90985,7 +90985,7 @@ stage: Modified - name: Added359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -90993,7 +90993,7 @@ stage: Added - name: Added360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91001,7 +91001,7 @@ stage: Added - name: Modified361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -91009,7 +91009,7 @@ stage: Modified - name: Added362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -91017,7 +91017,7 @@ stage: Added - name: Added363 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91025,7 +91025,7 @@ stage: Added - name: Modified364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -91033,7 +91033,7 @@ stage: Modified - name: Added365 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -91041,7 +91041,7 @@ stage: Added - name: Added366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91049,7 +91049,7 @@ stage: Added - name: Modified367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -91057,7 +91057,7 @@ stage: Modified - name: Added368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -91065,7 +91065,7 @@ stage: Added - name: Added369 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91073,7 +91073,7 @@ stage: Added - name: Modified370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -91081,7 +91081,7 @@ stage: Modified - name: Added371 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -91089,7 +91089,7 @@ stage: Added - name: Added372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91097,7 +91097,7 @@ stage: Added - name: Modified373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722887,"checksum":"bb4c80872f812345f90af0a5bdc9630cb959dbe4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -91105,14 +91105,14 @@ stage: Modified - name: Added374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added375 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91120,14 +91120,14 @@ stage: Added - name: Added376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added377 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91135,14 +91135,14 @@ stage: Added - name: Added378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91150,14 +91150,14 @@ stage: Added - name: Added380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added381 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91165,14 +91165,14 @@ stage: Added - name: Added382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added383 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91180,14 +91180,14 @@ stage: Added - name: Added384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91195,14 +91195,14 @@ stage: Added - name: Added386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91210,14 +91210,14 @@ stage: Added - name: Added388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91225,7 +91225,7 @@ stage: Added - name: Added390 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91241,7 +91241,7 @@ stage: Added - name: Added391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91249,7 +91249,7 @@ stage: Added - name: Modified392 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91269,7 +91269,7 @@ stage: Modified - name: Added393 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91285,7 +91285,7 @@ stage: Added - name: Added394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91293,7 +91293,7 @@ stage: Added - name: Modified395 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91313,7 +91313,7 @@ stage: Modified - name: Added396 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91329,7 +91329,7 @@ stage: Added - name: Added397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91337,7 +91337,7 @@ stage: Added - name: Modified398 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91357,7 +91357,7 @@ stage: Modified - name: Added399 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91373,7 +91373,7 @@ stage: Added - name: Added400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91381,7 +91381,7 @@ stage: Added - name: Modified401 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91401,7 +91401,7 @@ stage: Modified - name: Added402 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91417,7 +91417,7 @@ stage: Added - name: Added403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91425,7 +91425,7 @@ stage: Added - name: Modified404 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91445,7 +91445,7 @@ stage: Modified - name: Added405 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91461,7 +91461,7 @@ stage: Added - name: Added406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91469,7 +91469,7 @@ stage: Added - name: Modified407 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91489,7 +91489,7 @@ stage: Modified - name: Added408 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91505,7 +91505,7 @@ stage: Added - name: Added409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91513,7 +91513,7 @@ stage: Added - name: Modified410 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91533,7 +91533,7 @@ stage: Modified - name: Added411 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91549,7 +91549,7 @@ stage: Added - name: Added412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91557,7 +91557,7 @@ stage: Added - name: Modified413 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91577,7 +91577,7 @@ stage: Modified - name: Added414 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3400\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91593,7 +91593,7 @@ stage: Added - name: Added415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3400\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3400\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91601,7 +91601,7 @@ stage: Added - name: Added416 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3401\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91617,7 +91617,7 @@ stage: Added - name: Added417 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3401\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3401\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91625,7 +91625,7 @@ stage: Added - name: Added418 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3402\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91641,7 +91641,7 @@ stage: Added - name: Added419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3402\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3402\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91649,7 +91649,7 @@ stage: Added - name: Added420 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3403\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91665,7 +91665,7 @@ stage: Added - name: Added421 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3403\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3403\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91673,7 +91673,7 @@ stage: Added - name: Added422 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3404\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91689,7 +91689,7 @@ stage: Added - name: Added423 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3404\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3404\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91697,7 +91697,7 @@ stage: Added - name: Added424 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3405\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91713,7 +91713,7 @@ stage: Added - name: Added425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3405\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3405\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91721,7 +91721,7 @@ stage: Added - name: Added426 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3406\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91737,7 +91737,7 @@ stage: Added - name: Added427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3406\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3406\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91745,7 +91745,7 @@ stage: Added - name: Added428 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3407\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -91761,7 +91761,7 @@ stage: Added - name: Added429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3407\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3407\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91769,7 +91769,7 @@ stage: Added - name: Added430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91777,7 +91777,7 @@ stage: Added - name: Added431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91785,7 +91785,7 @@ stage: Added - name: Modified432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91793,7 +91793,7 @@ stage: Modified - name: Added433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91801,7 +91801,7 @@ stage: Added - name: Added434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91809,7 +91809,7 @@ stage: Added - name: Modified435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91817,7 +91817,7 @@ stage: Modified - name: Added436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91825,7 +91825,7 @@ stage: Added - name: Added437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91833,7 +91833,7 @@ stage: Added - name: Modified438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91841,7 +91841,7 @@ stage: Modified - name: Added439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91849,7 +91849,7 @@ stage: Added - name: Added440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91857,7 +91857,7 @@ stage: Added - name: Modified441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91865,7 +91865,7 @@ stage: Modified - name: Added442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91873,7 +91873,7 @@ stage: Added - name: Added443 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91881,7 +91881,7 @@ stage: Added - name: Modified444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91889,7 +91889,7 @@ stage: Modified - name: Added445 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91897,7 +91897,7 @@ stage: Added - name: Added446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91905,7 +91905,7 @@ stage: Added - name: Modified447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91913,7 +91913,7 @@ stage: Modified - name: Added448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91921,7 +91921,7 @@ stage: Added - name: Added449 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91929,7 +91929,7 @@ stage: Added - name: Modified450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91937,7 +91937,7 @@ stage: Modified - name: Added451 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91945,7 +91945,7 @@ stage: Added - name: Added452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91953,7 +91953,7 @@ stage: Added - name: Modified453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"dbd103d7660ec997d6bd49076684531154e38a12"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -91961,7 +91961,7 @@ stage: Modified - name: Added454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3416\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3416\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -91969,7 +91969,7 @@ stage: Added - name: Added455 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3416\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3416\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91977,7 +91977,7 @@ stage: Added - name: Added456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3417\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3417\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -91985,7 +91985,7 @@ stage: Added - name: Added457 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3417\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3417\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -91993,7 +91993,7 @@ stage: Added - name: Added458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3418\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3418\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -92001,7 +92001,7 @@ stage: Added - name: Added459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3418\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3418\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92009,7 +92009,7 @@ stage: Added - name: Added460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3419\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3419\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -92017,7 +92017,7 @@ stage: Added - name: Added461 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3419\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3419\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92025,7 +92025,7 @@ stage: Added - name: Added462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3420\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3420\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -92033,7 +92033,7 @@ stage: Added - name: Added463 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3420\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3420\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92041,7 +92041,7 @@ stage: Added - name: Added464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3421\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3421\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -92049,7 +92049,7 @@ stage: Added - name: Added465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3421\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3421\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92057,7 +92057,7 @@ stage: Added - name: Added466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3422\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3422\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -92065,7 +92065,7 @@ stage: Added - name: Added467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3422\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3422\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92073,7 +92073,7 @@ stage: Added - name: Added468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3423\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3423\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -92081,7 +92081,7 @@ stage: Added - name: Added469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3423\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3423\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92089,7 +92089,7 @@ stage: Added - name: Added470 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92104,7 +92104,7 @@ stage: Added - name: Added471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92112,7 +92112,7 @@ stage: Added - name: Modified472 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92131,7 +92131,7 @@ stage: Modified - name: Added473 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92146,7 +92146,7 @@ stage: Added - name: Added474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92154,7 +92154,7 @@ stage: Added - name: Modified475 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92173,7 +92173,7 @@ stage: Modified - name: Added476 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92188,7 +92188,7 @@ stage: Added - name: Added477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92196,7 +92196,7 @@ stage: Added - name: Modified478 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92215,7 +92215,7 @@ stage: Modified - name: Added479 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92230,7 +92230,7 @@ stage: Added - name: Added480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92238,7 +92238,7 @@ stage: Added - name: Modified481 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92257,7 +92257,7 @@ stage: Modified - name: Added482 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92272,7 +92272,7 @@ stage: Added - name: Added483 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92280,7 +92280,7 @@ stage: Added - name: Modified484 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92299,7 +92299,7 @@ stage: Modified - name: Added485 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92314,7 +92314,7 @@ stage: Added - name: Added486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92322,7 +92322,7 @@ stage: Added - name: Modified487 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92341,7 +92341,7 @@ stage: Modified - name: Added488 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92356,7 +92356,7 @@ stage: Added - name: Added489 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92364,7 +92364,7 @@ stage: Added - name: Modified490 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92383,7 +92383,7 @@ stage: Modified - name: Added491 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92398,7 +92398,7 @@ stage: Added - name: Added492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92406,7 +92406,7 @@ stage: Added - name: Modified493 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92425,7 +92425,7 @@ stage: Modified - name: Added494 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3432\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92440,7 +92440,7 @@ stage: Added - name: Added495 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3432\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3432\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92448,7 +92448,7 @@ stage: Added - name: Added496 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3433\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92463,7 +92463,7 @@ stage: Added - name: Added497 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3433\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3433\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92471,7 +92471,7 @@ stage: Added - name: Added498 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3434\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92486,7 +92486,7 @@ stage: Added - name: Added499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3434\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3434\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92494,7 +92494,7 @@ stage: Added - name: Added500 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3435\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92509,7 +92509,7 @@ stage: Added - name: Added501 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3435\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3435\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92517,7 +92517,7 @@ stage: Added - name: Added502 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3436\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92532,7 +92532,7 @@ stage: Added - name: Added503 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3436\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3436\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92540,7 +92540,7 @@ stage: Added - name: Added504 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3437\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92555,7 +92555,7 @@ stage: Added - name: Added505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3437\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3437\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92563,7 +92563,7 @@ stage: Added - name: Added506 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3438\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92578,7 +92578,7 @@ stage: Added - name: Added507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92586,7 +92586,7 @@ stage: Added - name: Added508 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3439\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92601,7 +92601,7 @@ stage: Added - name: Added509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3439\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3439\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92609,14 +92609,14 @@ stage: Added - name: Added510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Added - name: Added511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92624,21 +92624,21 @@ stage: Added - name: Modified512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Modified - name: Added513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Added - name: Added514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92646,21 +92646,21 @@ stage: Added - name: Modified515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Modified - name: Added516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Added - name: Added517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92668,21 +92668,21 @@ stage: Added - name: Modified518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Modified - name: Added519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Added - name: Added520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92690,21 +92690,21 @@ stage: Added - name: Modified521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Modified - name: Added522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Added - name: Added523 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92712,21 +92712,21 @@ stage: Added - name: Modified524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Modified - name: Added525 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Added - name: Added526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92734,21 +92734,21 @@ stage: Added - name: Modified527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Modified - name: Added528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Added - name: Added529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92756,21 +92756,21 @@ stage: Added - name: Modified530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Modified - name: Added531 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Added - name: Added532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92778,21 +92778,21 @@ stage: Added - name: Modified533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722887,"checksum":"dc2eeb75e7cc053f5537a3311244dcf12993c283"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723063, "checksum": "58709fd6efda779a10de280edc4ffe110c3fc72e"}}' stage: Modified - name: Added534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3448\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3448\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added535 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3448\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3448\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92800,14 +92800,14 @@ stage: Added - name: Added536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3449\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3449\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added537 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3449\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3449\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92815,14 +92815,14 @@ stage: Added - name: Added538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3450\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3450\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3450\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3450\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92830,14 +92830,14 @@ stage: Added - name: Added540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3451\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3451\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added541 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3451\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3451\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92845,14 +92845,14 @@ stage: Added - name: Added542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3452\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3452\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added543 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3452\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3452\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92860,14 +92860,14 @@ stage: Added - name: Added544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3453\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3453\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3453\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3453\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92875,14 +92875,14 @@ stage: Added - name: Added546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3454\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3454\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3454\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3454\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92890,14 +92890,14 @@ stage: Added - name: Added548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3455\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3455\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3455\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3455\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92905,7 +92905,7 @@ stage: Added - name: Added550 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92921,7 +92921,7 @@ stage: Added - name: Added551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92929,7 +92929,7 @@ stage: Added - name: Modified552 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92949,7 +92949,7 @@ stage: Modified - name: Added553 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92965,7 +92965,7 @@ stage: Added - name: Added554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -92973,7 +92973,7 @@ stage: Added - name: Modified555 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -92993,7 +92993,7 @@ stage: Modified - name: Added556 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93009,7 +93009,7 @@ stage: Added - name: Added557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93017,7 +93017,7 @@ stage: Added - name: Modified558 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93037,7 +93037,7 @@ stage: Modified - name: Added559 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93053,7 +93053,7 @@ stage: Added - name: Added560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93061,7 +93061,7 @@ stage: Added - name: Modified561 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93081,7 +93081,7 @@ stage: Modified - name: Added562 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93097,7 +93097,7 @@ stage: Added - name: Added563 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93105,7 +93105,7 @@ stage: Added - name: Modified564 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93125,7 +93125,7 @@ stage: Modified - name: Added565 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93141,7 +93141,7 @@ stage: Added - name: Added566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93149,7 +93149,7 @@ stage: Added - name: Modified567 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93169,7 +93169,7 @@ stage: Modified - name: Added568 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93185,7 +93185,7 @@ stage: Added - name: Added569 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93193,7 +93193,7 @@ stage: Added - name: Modified570 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93213,7 +93213,7 @@ stage: Modified - name: Added571 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93229,7 +93229,7 @@ stage: Added - name: Added572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93237,7 +93237,7 @@ stage: Added - name: Modified573 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93257,7 +93257,7 @@ stage: Modified - name: Added574 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3464\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93273,7 +93273,7 @@ stage: Added - name: Added575 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3464\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3464\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93281,7 +93281,7 @@ stage: Added - name: Added576 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3465\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93297,7 +93297,7 @@ stage: Added - name: Added577 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3465\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3465\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93305,7 +93305,7 @@ stage: Added - name: Added578 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3466\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93321,7 +93321,7 @@ stage: Added - name: Added579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3466\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3466\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93329,7 +93329,7 @@ stage: Added - name: Added580 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3467\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93345,7 +93345,7 @@ stage: Added - name: Added581 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3467\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3467\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93353,7 +93353,7 @@ stage: Added - name: Added582 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3468\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93369,7 +93369,7 @@ stage: Added - name: Added583 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3468\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3468\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93377,7 +93377,7 @@ stage: Added - name: Added584 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3469\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93393,7 +93393,7 @@ stage: Added - name: Added585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3469\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3469\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93401,7 +93401,7 @@ stage: Added - name: Added586 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3470\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93417,7 +93417,7 @@ stage: Added - name: Added587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3470\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3470\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93425,7 +93425,7 @@ stage: Added - name: Added588 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3471\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93441,7 +93441,7 @@ stage: Added - name: Added589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3471\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3471\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93449,7 +93449,7 @@ stage: Added - name: Added590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93457,7 +93457,7 @@ stage: Added - name: Added591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93465,7 +93465,7 @@ stage: Added - name: Modified592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93473,7 +93473,7 @@ stage: Modified - name: Added593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93481,7 +93481,7 @@ stage: Added - name: Added594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93489,7 +93489,7 @@ stage: Added - name: Modified595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93497,7 +93497,7 @@ stage: Modified - name: Added596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93505,7 +93505,7 @@ stage: Added - name: Added597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93513,7 +93513,7 @@ stage: Added - name: Modified598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93521,7 +93521,7 @@ stage: Modified - name: Added599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93529,7 +93529,7 @@ stage: Added - name: Added600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93537,7 +93537,7 @@ stage: Added - name: Modified601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93545,7 +93545,7 @@ stage: Modified - name: Added602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93553,7 +93553,7 @@ stage: Added - name: Added603 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93561,7 +93561,7 @@ stage: Added - name: Modified604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93569,7 +93569,7 @@ stage: Modified - name: Added605 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93577,7 +93577,7 @@ stage: Added - name: Added606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93585,7 +93585,7 @@ stage: Added - name: Modified607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93593,7 +93593,7 @@ stage: Modified - name: Added608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93601,7 +93601,7 @@ stage: Added - name: Added609 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93609,7 +93609,7 @@ stage: Added - name: Modified610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93617,7 +93617,7 @@ stage: Modified - name: Added611 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93625,7 +93625,7 @@ stage: Added - name: Added612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93633,7 +93633,7 @@ stage: Added - name: Modified613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722887,"checksum":"bd49c4d09fe7ec1829a8f1954c22ef3c29b4a38a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93641,7 +93641,7 @@ stage: Modified - name: Added614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3438\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3438\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "size": 6, "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93649,7 +93649,7 @@ stage: Added - name: Added615 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93657,7 +93657,7 @@ stage: Added - name: Added616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93665,7 +93665,7 @@ stage: Added - name: Added617 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93673,7 +93673,7 @@ stage: Added - name: Added618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93681,7 +93681,7 @@ stage: Added - name: Added619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93689,7 +93689,7 @@ stage: Added - name: Added620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93697,7 +93697,7 @@ stage: Added - name: Added621 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93705,7 +93705,7 @@ stage: Added - name: Added622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93713,7 +93713,7 @@ stage: Added - name: Added623 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93721,7 +93721,7 @@ stage: Added - name: Added624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93729,7 +93729,7 @@ stage: Added - name: Added625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93737,7 +93737,7 @@ stage: Added - name: Added626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93745,7 +93745,7 @@ stage: Added - name: Added627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93753,7 +93753,7 @@ stage: Added - name: Added628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -93761,7 +93761,7 @@ stage: Added - name: Added629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93769,7 +93769,7 @@ stage: Added - name: Added630 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93785,7 +93785,7 @@ stage: Added - name: Added631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93793,7 +93793,7 @@ stage: Added - name: Modified632 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93813,7 +93813,7 @@ stage: Modified - name: Added633 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93829,7 +93829,7 @@ stage: Added - name: Added634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93837,7 +93837,7 @@ stage: Added - name: Modified635 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93857,7 +93857,7 @@ stage: Modified - name: Added636 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93873,7 +93873,7 @@ stage: Added - name: Added637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93881,7 +93881,7 @@ stage: Added - name: Modified638 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93901,7 +93901,7 @@ stage: Modified - name: Added639 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93917,7 +93917,7 @@ stage: Added - name: Added640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -93925,7 +93925,7 @@ stage: Added - name: Modified641 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93945,7 +93945,7 @@ stage: Modified - name: Added642 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93961,7 +93961,7 @@ stage: Added - name: Added643 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -93969,7 +93969,7 @@ stage: Added - name: Modified644 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -93989,7 +93989,7 @@ stage: Modified - name: Added645 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94005,7 +94005,7 @@ stage: Added - name: Added646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94013,7 +94013,7 @@ stage: Added - name: Modified647 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94033,7 +94033,7 @@ stage: Modified - name: Added648 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94049,7 +94049,7 @@ stage: Added - name: Added649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94057,7 +94057,7 @@ stage: Added - name: Modified650 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94077,7 +94077,7 @@ stage: Modified - name: Added651 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94093,7 +94093,7 @@ stage: Added - name: Added652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94101,7 +94101,7 @@ stage: Added - name: Modified653 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94121,7 +94121,7 @@ stage: Modified - name: Added654 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3496\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94136,7 +94136,7 @@ stage: Added - name: Added655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3496\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3496\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94144,7 +94144,7 @@ stage: Added - name: Added656 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3497\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94159,7 +94159,7 @@ stage: Added - name: Added657 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3497\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3497\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94167,7 +94167,7 @@ stage: Added - name: Added658 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3498\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94182,7 +94182,7 @@ stage: Added - name: Added659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3498\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3498\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94190,7 +94190,7 @@ stage: Added - name: Added660 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3499\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94205,7 +94205,7 @@ stage: Added - name: Added661 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3499\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3499\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94213,7 +94213,7 @@ stage: Added - name: Added662 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3500\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94228,7 +94228,7 @@ stage: Added - name: Added663 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3500\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3500\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94236,7 +94236,7 @@ stage: Added - name: Added664 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3501\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94251,7 +94251,7 @@ stage: Added - name: Added665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3501\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3501\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94259,7 +94259,7 @@ stage: Added - name: Added666 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3502\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94274,7 +94274,7 @@ stage: Added - name: Added667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3502\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3502\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94282,7 +94282,7 @@ stage: Added - name: Added668 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3503\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94297,7 +94297,7 @@ stage: Added - name: Added669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3503\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3503\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94305,7 +94305,7 @@ stage: Added - name: Added670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94313,7 +94313,7 @@ stage: Added - name: Added671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94321,7 +94321,7 @@ stage: Added - name: Modified672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94329,7 +94329,7 @@ stage: Modified - name: Added673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94337,7 +94337,7 @@ stage: Added - name: Added674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94345,7 +94345,7 @@ stage: Added - name: Modified675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94353,7 +94353,7 @@ stage: Modified - name: Added676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94361,7 +94361,7 @@ stage: Added - name: Added677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94369,7 +94369,7 @@ stage: Added - name: Modified678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94377,7 +94377,7 @@ stage: Modified - name: Added679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94385,7 +94385,7 @@ stage: Added - name: Added680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94393,7 +94393,7 @@ stage: Added - name: Modified681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94401,7 +94401,7 @@ stage: Modified - name: Added682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94409,7 +94409,7 @@ stage: Added - name: Added683 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94417,7 +94417,7 @@ stage: Added - name: Modified684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94425,7 +94425,7 @@ stage: Modified - name: Added685 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94433,7 +94433,7 @@ stage: Added - name: Added686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94441,7 +94441,7 @@ stage: Added - name: Modified687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94449,7 +94449,7 @@ stage: Modified - name: Added688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94457,7 +94457,7 @@ stage: Added - name: Added689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94465,7 +94465,7 @@ stage: Added - name: Modified690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94473,7 +94473,7 @@ stage: Modified - name: Added691 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94481,7 +94481,7 @@ stage: Added - name: Added692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94489,7 +94489,7 @@ stage: Added - name: Modified693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723063, @@ -94497,14 +94497,14 @@ stage: Modified - name: Added694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94512,14 +94512,14 @@ stage: Added - name: Added696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added697 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94527,14 +94527,14 @@ stage: Added - name: Added698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94542,14 +94542,14 @@ stage: Added - name: Added700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added701 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94557,14 +94557,14 @@ stage: Added - name: Added702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added703 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94572,14 +94572,14 @@ stage: Added - name: Added704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94587,14 +94587,14 @@ stage: Added - name: Added706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94602,14 +94602,14 @@ stage: Added - name: Added708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94617,7 +94617,7 @@ stage: Added - name: Added710 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94633,7 +94633,7 @@ stage: Added - name: Added711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94641,7 +94641,7 @@ stage: Added - name: Modified712 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94661,7 +94661,7 @@ stage: Modified - name: Added713 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94677,7 +94677,7 @@ stage: Added - name: Added714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94685,7 +94685,7 @@ stage: Added - name: Modified715 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94705,7 +94705,7 @@ stage: Modified - name: Added716 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94721,7 +94721,7 @@ stage: Added - name: Added717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -94729,7 +94729,7 @@ stage: Added - name: Modified718 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94749,7 +94749,7 @@ stage: Modified - name: Added719 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94765,7 +94765,7 @@ stage: Added - name: Added720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94773,7 +94773,7 @@ stage: Added - name: Modified721 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94793,7 +94793,7 @@ stage: Modified - name: Added722 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94809,7 +94809,7 @@ stage: Added - name: Added723 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94817,7 +94817,7 @@ stage: Added - name: Modified724 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94837,7 +94837,7 @@ stage: Modified - name: Added725 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94853,7 +94853,7 @@ stage: Added - name: Added726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94861,7 +94861,7 @@ stage: Added - name: Modified727 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94881,7 +94881,7 @@ stage: Modified - name: Added728 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94897,7 +94897,7 @@ stage: Added - name: Added729 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94905,7 +94905,7 @@ stage: Added - name: Modified730 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94925,7 +94925,7 @@ stage: Modified - name: Added731 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94941,7 +94941,7 @@ stage: Added - name: Added732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -94949,7 +94949,7 @@ stage: Added - name: Modified733 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94969,7 +94969,7 @@ stage: Modified - name: Added734 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3528\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -94985,7 +94985,7 @@ stage: Added - name: Added735 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3528\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3528\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -94993,7 +94993,7 @@ stage: Added - name: Added736 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3529\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95009,7 +95009,7 @@ stage: Added - name: Added737 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3529\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3529\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95017,7 +95017,7 @@ stage: Added - name: Added738 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3530\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95033,7 +95033,7 @@ stage: Added - name: Added739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3530\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3530\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95041,7 +95041,7 @@ stage: Added - name: Added740 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3531\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95057,7 +95057,7 @@ stage: Added - name: Added741 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3531\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3531\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95065,7 +95065,7 @@ stage: Added - name: Added742 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3532\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95081,7 +95081,7 @@ stage: Added - name: Added743 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3532\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3532\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95089,7 +95089,7 @@ stage: Added - name: Added744 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3533\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95105,7 +95105,7 @@ stage: Added - name: Added745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3533\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3533\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95113,7 +95113,7 @@ stage: Added - name: Added746 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3534\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95129,7 +95129,7 @@ stage: Added - name: Added747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3534\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3534\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95137,7 +95137,7 @@ stage: Added - name: Added748 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3535\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95153,7 +95153,7 @@ stage: Added - name: Added749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3535\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3535\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95161,7 +95161,7 @@ stage: Added - name: Added750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95169,7 +95169,7 @@ stage: Added - name: Added751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95177,7 +95177,7 @@ stage: Added - name: Modified752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95185,7 +95185,7 @@ stage: Modified - name: Added753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95193,7 +95193,7 @@ stage: Added - name: Added754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95201,7 +95201,7 @@ stage: Added - name: Modified755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95209,7 +95209,7 @@ stage: Modified - name: Added756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95217,7 +95217,7 @@ stage: Added - name: Added757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95225,7 +95225,7 @@ stage: Added - name: Modified758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95233,7 +95233,7 @@ stage: Modified - name: Added759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95241,7 +95241,7 @@ stage: Added - name: Added760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95249,7 +95249,7 @@ stage: Added - name: Modified761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95257,7 +95257,7 @@ stage: Modified - name: Added762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95265,7 +95265,7 @@ stage: Added - name: Added763 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95273,7 +95273,7 @@ stage: Added - name: Modified764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95281,7 +95281,7 @@ stage: Modified - name: Added765 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95289,7 +95289,7 @@ stage: Added - name: Added766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95297,7 +95297,7 @@ stage: Added - name: Modified767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95305,7 +95305,7 @@ stage: Modified - name: Added768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95313,7 +95313,7 @@ stage: Added - name: Added769 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95321,7 +95321,7 @@ stage: Added - name: Modified770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95329,7 +95329,7 @@ stage: Modified - name: Added771 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95337,7 +95337,7 @@ stage: Added - name: Added772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95345,7 +95345,7 @@ stage: Added - name: Modified773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -95353,7 +95353,7 @@ stage: Modified - name: Added774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3544\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3544\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -95361,7 +95361,7 @@ stage: Added - name: Added775 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3544\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3544\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95369,7 +95369,7 @@ stage: Added - name: Added776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3545\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3545\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -95377,7 +95377,7 @@ stage: Added - name: Added777 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3545\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3545\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95385,7 +95385,7 @@ stage: Added - name: Added778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3546\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3546\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -95393,7 +95393,7 @@ stage: Added - name: Added779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3546\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3546\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95401,7 +95401,7 @@ stage: Added - name: Added780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3547\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3547\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -95409,7 +95409,7 @@ stage: Added - name: Added781 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3547\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3547\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95417,7 +95417,7 @@ stage: Added - name: Added782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3548\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3548\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -95425,7 +95425,7 @@ stage: Added - name: Added783 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3548\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3548\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95433,7 +95433,7 @@ stage: Added - name: Added784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3549\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3549\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -95441,7 +95441,7 @@ stage: Added - name: Added785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3549\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3549\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95449,7 +95449,7 @@ stage: Added - name: Added786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3550\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3550\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -95457,7 +95457,7 @@ stage: Added - name: Added787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3550\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3550\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95465,7 +95465,7 @@ stage: Added - name: Added788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3551\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3551\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -95473,7 +95473,7 @@ stage: Added - name: Added789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3551\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3551\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95481,7 +95481,7 @@ stage: Added - name: Added790 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95496,7 +95496,7 @@ stage: Added - name: Added791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95504,7 +95504,7 @@ stage: Added - name: Modified792 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95523,7 +95523,7 @@ stage: Modified - name: Added793 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95538,7 +95538,7 @@ stage: Added - name: Added794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95546,7 +95546,7 @@ stage: Added - name: Modified795 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95565,7 +95565,7 @@ stage: Modified - name: Added796 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95580,7 +95580,7 @@ stage: Added - name: Added797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95588,7 +95588,7 @@ stage: Added - name: Modified798 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95607,7 +95607,7 @@ stage: Modified - name: Added799 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95622,7 +95622,7 @@ stage: Added - name: Added800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95630,7 +95630,7 @@ stage: Added - name: Modified801 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95649,7 +95649,7 @@ stage: Modified - name: Added802 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95664,7 +95664,7 @@ stage: Added - name: Added803 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95672,7 +95672,7 @@ stage: Added - name: Modified804 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95691,7 +95691,7 @@ stage: Modified - name: Added805 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95706,7 +95706,7 @@ stage: Added - name: Added806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95714,7 +95714,7 @@ stage: Added - name: Modified807 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95733,7 +95733,7 @@ stage: Modified - name: Added808 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95748,7 +95748,7 @@ stage: Added - name: Added809 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95756,7 +95756,7 @@ stage: Added - name: Modified810 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95775,7 +95775,7 @@ stage: Modified - name: Added811 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95790,7 +95790,7 @@ stage: Added - name: Added812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95798,7 +95798,7 @@ stage: Added - name: Modified813 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95817,7 +95817,7 @@ stage: Modified - name: Added814 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3560\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95832,7 +95832,7 @@ stage: Added - name: Added815 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95840,7 +95840,7 @@ stage: Added - name: Added816 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3561\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95855,7 +95855,7 @@ stage: Added - name: Added817 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3561\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3561\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95863,7 +95863,7 @@ stage: Added - name: Added818 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3562\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95878,7 +95878,7 @@ stage: Added - name: Added819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3562\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3562\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95886,7 +95886,7 @@ stage: Added - name: Added820 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3563\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95901,7 +95901,7 @@ stage: Added - name: Added821 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3563\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3563\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -95909,7 +95909,7 @@ stage: Added - name: Added822 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3564\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95924,7 +95924,7 @@ stage: Added - name: Added823 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3564\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3564\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95932,7 +95932,7 @@ stage: Added - name: Added824 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3565\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95947,7 +95947,7 @@ stage: Added - name: Added825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3565\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3565\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95955,7 +95955,7 @@ stage: Added - name: Added826 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3566\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95970,7 +95970,7 @@ stage: Added - name: Added827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3566\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3566\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -95978,7 +95978,7 @@ stage: Added - name: Added828 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3567\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -95993,7 +95993,7 @@ stage: Added - name: Added829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3567\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3567\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -96001,14 +96001,14 @@ stage: Added - name: Added830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -96016,21 +96016,21 @@ stage: Added - name: Modified832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -96038,21 +96038,21 @@ stage: Added - name: Modified835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -96060,21 +96060,21 @@ stage: Added - name: Modified838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -96082,21 +96082,21 @@ stage: Added - name: Modified841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added843 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -96104,21 +96104,21 @@ stage: Added - name: Modified844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added845 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -96126,21 +96126,21 @@ stage: Added - name: Modified847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added849 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -96148,21 +96148,21 @@ stage: Added - name: Modified850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added851 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -96170,21 +96170,21 @@ stage: Added - name: Modified853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3576\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3576\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added855 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3576\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3576\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -96192,14 +96192,14 @@ stage: Added - name: Added856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3577\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3577\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added857 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3577\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3577\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -96207,14 +96207,14 @@ stage: Added - name: Added858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3578\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3578\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3578\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3578\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -96222,14 +96222,14 @@ stage: Added - name: Added860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3579\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3579\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added861 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3579\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3579\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -96237,14 +96237,14 @@ stage: Added - name: Added862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3580\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3580\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added863 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3580\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3580\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -96252,14 +96252,14 @@ stage: Added - name: Added864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3581\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3581\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3581\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3581\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -96267,14 +96267,14 @@ stage: Added - name: Added866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3582\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3582\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3582\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3582\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -96282,14 +96282,14 @@ stage: Added - name: Added868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3583\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3583\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3583\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3583\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "checksum": @@ -96297,7 +96297,7 @@ stage: Added - name: Added870 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96313,7 +96313,7 @@ stage: Added - name: Added871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96322,7 +96322,7 @@ stage: Added - name: Modified872 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96342,7 +96342,7 @@ stage: Modified - name: Added873 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96358,7 +96358,7 @@ stage: Added - name: Added874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96367,7 +96367,7 @@ stage: Added - name: Modified875 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96387,7 +96387,7 @@ stage: Modified - name: Added876 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96403,7 +96403,7 @@ stage: Added - name: Added877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96412,7 +96412,7 @@ stage: Added - name: Modified878 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96432,7 +96432,7 @@ stage: Modified - name: Added879 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96448,7 +96448,7 @@ stage: Added - name: Added880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96457,7 +96457,7 @@ stage: Added - name: Modified881 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96477,7 +96477,7 @@ stage: Modified - name: Added882 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96493,7 +96493,7 @@ stage: Added - name: Added883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -96501,7 +96501,7 @@ stage: Added - name: Modified884 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96521,7 +96521,7 @@ stage: Modified - name: Added885 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96537,7 +96537,7 @@ stage: Added - name: Added886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -96545,7 +96545,7 @@ stage: Added - name: Modified887 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96565,7 +96565,7 @@ stage: Modified - name: Added888 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96581,7 +96581,7 @@ stage: Added - name: Added889 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -96589,7 +96589,7 @@ stage: Added - name: Modified890 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96609,7 +96609,7 @@ stage: Modified - name: Added891 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96625,7 +96625,7 @@ stage: Added - name: Added892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -96633,7 +96633,7 @@ stage: Added - name: Modified893 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96653,7 +96653,7 @@ stage: Modified - name: Added894 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3592\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96669,7 +96669,7 @@ stage: Added - name: Added895 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3592\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3592\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96678,7 +96678,7 @@ stage: Added - name: Added896 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3593\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96694,7 +96694,7 @@ stage: Added - name: Added897 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3593\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3593\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96703,7 +96703,7 @@ stage: Added - name: Added898 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3594\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96719,7 +96719,7 @@ stage: Added - name: Added899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3594\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3594\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96728,7 +96728,7 @@ stage: Added - name: Added900 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3595\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96744,7 +96744,7 @@ stage: Added - name: Added901 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3595\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3595\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96753,7 +96753,7 @@ stage: Added - name: Added902 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3596\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96769,7 +96769,7 @@ stage: Added - name: Added903 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3596\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3596\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -96777,7 +96777,7 @@ stage: Added - name: Added904 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3597\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96793,7 +96793,7 @@ stage: Added - name: Added905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3597\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3597\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -96801,7 +96801,7 @@ stage: Added - name: Added906 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3598\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96817,7 +96817,7 @@ stage: Added - name: Added907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3598\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3598\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -96825,7 +96825,7 @@ stage: Added - name: Added908 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3599\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -96841,7 +96841,7 @@ stage: Added - name: Added909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3599\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3599\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -96849,7 +96849,7 @@ stage: Added - name: Added910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -96857,7 +96857,7 @@ stage: Added - name: Added911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96866,7 +96866,7 @@ stage: Added - name: Modified912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -96874,7 +96874,7 @@ stage: Modified - name: Added913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -96882,7 +96882,7 @@ stage: Added - name: Added914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96891,7 +96891,7 @@ stage: Added - name: Modified915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -96899,7 +96899,7 @@ stage: Modified - name: Added916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3560\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3560\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", @@ -96907,7 +96907,7 @@ stage: Added - name: Added917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96916,7 +96916,7 @@ stage: Added - name: Modified918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -96924,7 +96924,7 @@ stage: Modified - name: Added919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -96932,7 +96932,7 @@ stage: Added - name: Added920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -96941,7 +96941,7 @@ stage: Added - name: Modified921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -96949,7 +96949,7 @@ stage: Modified - name: Added922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -96957,7 +96957,7 @@ stage: Added - name: Added923 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -96965,7 +96965,7 @@ stage: Added - name: Modified924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -96973,7 +96973,7 @@ stage: Modified - name: Added925 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -96981,7 +96981,7 @@ stage: Added - name: Added926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -96989,7 +96989,7 @@ stage: Added - name: Modified927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -96997,7 +96997,7 @@ stage: Modified - name: Added928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97005,7 +97005,7 @@ stage: Added - name: Added929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97013,7 +97013,7 @@ stage: Added - name: Modified930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97021,7 +97021,7 @@ stage: Modified - name: Added931 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97029,7 +97029,7 @@ stage: Added - name: Added932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97037,7 +97037,7 @@ stage: Added - name: Modified933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97045,7 +97045,7 @@ stage: Modified - name: Added934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97053,7 +97053,7 @@ stage: Added - name: Added935 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97062,7 +97062,7 @@ stage: Added - name: Added936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97070,7 +97070,7 @@ stage: Added - name: Added937 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97079,7 +97079,7 @@ stage: Added - name: Added938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97087,7 +97087,7 @@ stage: Added - name: Added939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97096,7 +97096,7 @@ stage: Added - name: Added940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97104,7 +97104,7 @@ stage: Added - name: Added941 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97113,7 +97113,7 @@ stage: Added - name: Added942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97121,7 +97121,7 @@ stage: Added - name: Added943 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97129,7 +97129,7 @@ stage: Added - name: Added944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97137,7 +97137,7 @@ stage: Added - name: Added945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97145,7 +97145,7 @@ stage: Added - name: Added946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97153,7 +97153,7 @@ stage: Added - name: Added947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97161,7 +97161,7 @@ stage: Added - name: Added948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97169,7 +97169,7 @@ stage: Added - name: Added949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97177,7 +97177,7 @@ stage: Added - name: Added950 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97193,7 +97193,7 @@ stage: Added - name: Added951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97202,7 +97202,7 @@ stage: Added - name: Modified952 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97222,7 +97222,7 @@ stage: Modified - name: Added953 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97238,7 +97238,7 @@ stage: Added - name: Added954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97247,7 +97247,7 @@ stage: Added - name: Modified955 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97267,7 +97267,7 @@ stage: Modified - name: Added956 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97283,7 +97283,7 @@ stage: Added - name: Added957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97292,7 +97292,7 @@ stage: Added - name: Modified958 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97312,7 +97312,7 @@ stage: Modified - name: Added959 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97328,7 +97328,7 @@ stage: Added - name: Added960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97337,7 +97337,7 @@ stage: Added - name: Modified961 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97357,7 +97357,7 @@ stage: Modified - name: Added962 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97373,7 +97373,7 @@ stage: Added - name: Added963 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97381,7 +97381,7 @@ stage: Added - name: Modified964 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97401,7 +97401,7 @@ stage: Modified - name: Added965 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97417,7 +97417,7 @@ stage: Added - name: Added966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97425,7 +97425,7 @@ stage: Added - name: Modified967 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97445,7 +97445,7 @@ stage: Modified - name: Added968 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97461,7 +97461,7 @@ stage: Added - name: Added969 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97469,7 +97469,7 @@ stage: Added - name: Modified970 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97489,7 +97489,7 @@ stage: Modified - name: Added971 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97505,7 +97505,7 @@ stage: Added - name: Added972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97513,7 +97513,7 @@ stage: Added - name: Modified973 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97533,7 +97533,7 @@ stage: Modified - name: Added974 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3624\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97548,7 +97548,7 @@ stage: Added - name: Added975 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3624\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3624\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97557,7 +97557,7 @@ stage: Added - name: Added976 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3625\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97572,7 +97572,7 @@ stage: Added - name: Added977 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3625\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3625\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97581,7 +97581,7 @@ stage: Added - name: Added978 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3626\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97596,7 +97596,7 @@ stage: Added - name: Added979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3626\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3626\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97605,7 +97605,7 @@ stage: Added - name: Added980 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3627\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97620,7 +97620,7 @@ stage: Added - name: Added981 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3627\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3627\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97629,7 +97629,7 @@ stage: Added - name: Added982 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3628\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97644,7 +97644,7 @@ stage: Added - name: Added983 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3628\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3628\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97652,7 +97652,7 @@ stage: Added - name: Added984 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3629\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97667,7 +97667,7 @@ stage: Added - name: Added985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3629\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3629\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97675,7 +97675,7 @@ stage: Added - name: Added986 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3630\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97690,7 +97690,7 @@ stage: Added - name: Added987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3630\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3630\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97698,7 +97698,7 @@ stage: Added - name: Added988 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3631\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -97713,7 +97713,7 @@ stage: Added - name: Added989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3631\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3631\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97721,7 +97721,7 @@ stage: Added - name: Added990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97729,7 +97729,7 @@ stage: Added - name: Added991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97738,7 +97738,7 @@ stage: Added - name: Modified992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97746,7 +97746,7 @@ stage: Modified - name: Added993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97754,7 +97754,7 @@ stage: Added - name: Added994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97763,7 +97763,7 @@ stage: Added - name: Modified995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97771,7 +97771,7 @@ stage: Modified - name: Added996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97779,7 +97779,7 @@ stage: Added - name: Added997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97788,7 +97788,7 @@ stage: Added - name: Modified998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97796,7 +97796,7 @@ stage: Modified - name: Added999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97804,7 +97804,7 @@ stage: Added - name: Added1000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97813,7 +97813,7 @@ stage: Added - name: Modified1001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97821,7 +97821,7 @@ stage: Modified - name: Added1002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97829,7 +97829,7 @@ stage: Added - name: Added1003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97837,7 +97837,7 @@ stage: Added - name: Modified1004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97845,7 +97845,7 @@ stage: Modified - name: Added1005 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97853,7 +97853,7 @@ stage: Added - name: Added1006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97861,7 +97861,7 @@ stage: Added - name: Modified1007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97869,7 +97869,7 @@ stage: Modified - name: Added1008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97877,7 +97877,7 @@ stage: Added - name: Added1009 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97885,7 +97885,7 @@ stage: Added - name: Modified1010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97893,7 +97893,7 @@ stage: Modified - name: Added1011 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97901,7 +97901,7 @@ stage: Added - name: Added1012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -97909,7 +97909,7 @@ stage: Added - name: Modified1013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723064, @@ -97917,14 +97917,14 @@ stage: Modified - name: Added1014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1015 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97933,14 +97933,14 @@ stage: Added - name: Added1016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1017 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97949,14 +97949,14 @@ stage: Added - name: Added1018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97965,14 +97965,14 @@ stage: Added - name: Added1020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1021 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -97981,14 +97981,14 @@ stage: Added - name: Added1022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1023 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -97996,14 +97996,14 @@ stage: Added - name: Added1024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98011,14 +98011,14 @@ stage: Added - name: Added1026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98026,14 +98026,14 @@ stage: Added - name: Added1028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key", "arch": "[x64]", "timestamp": 1606769888, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98041,7 +98041,7 @@ stage: Added - name: Added1030 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98057,7 +98057,7 @@ stage: Added - name: Added1031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98066,7 +98066,7 @@ stage: Added - name: Modified1032 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98086,7 +98086,7 @@ stage: Modified - name: Added1033 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98102,7 +98102,7 @@ stage: Added - name: Added1034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98111,7 +98111,7 @@ stage: Added - name: Modified1035 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98131,7 +98131,7 @@ stage: Modified - name: Added1036 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98147,7 +98147,7 @@ stage: Added - name: Added1037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98156,7 +98156,7 @@ stage: Added - name: Modified1038 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98176,7 +98176,7 @@ stage: Modified - name: Added1039 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98192,7 +98192,7 @@ stage: Added - name: Added1040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98201,7 +98201,7 @@ stage: Added - name: Modified1041 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98221,7 +98221,7 @@ stage: Modified - name: Added1042 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98237,7 +98237,7 @@ stage: Added - name: Added1043 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98245,7 +98245,7 @@ stage: Added - name: Modified1044 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98265,7 +98265,7 @@ stage: Modified - name: Added1045 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98281,7 +98281,7 @@ stage: Added - name: Added1046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98289,7 +98289,7 @@ stage: Added - name: Modified1047 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98309,7 +98309,7 @@ stage: Modified - name: Added1048 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98325,7 +98325,7 @@ stage: Added - name: Added1049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98333,7 +98333,7 @@ stage: Added - name: Modified1050 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98353,7 +98353,7 @@ stage: Modified - name: Added1051 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98369,7 +98369,7 @@ stage: Added - name: Added1052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98377,7 +98377,7 @@ stage: Added - name: Modified1053 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98397,7 +98397,7 @@ stage: Modified - name: Added1054 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3656\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769888,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98413,7 +98413,7 @@ stage: Added - name: Added1055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3656\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3656\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98422,7 +98422,7 @@ stage: Added - name: Added1056 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3657\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98438,7 +98438,7 @@ stage: Added - name: Added1057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3657\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3657\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98447,7 +98447,7 @@ stage: Added - name: Added1058 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3658\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98463,7 +98463,7 @@ stage: Added - name: Added1059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3658\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3658\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98472,7 +98472,7 @@ stage: Added - name: Added1060 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3659\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98488,7 +98488,7 @@ stage: Added - name: Added1061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3659\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3659\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98497,7 +98497,7 @@ stage: Added - name: Added1062 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3660\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98513,7 +98513,7 @@ stage: Added - name: Added1063 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3660\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3660\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98521,7 +98521,7 @@ stage: Added - name: Added1064 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3661\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98537,7 +98537,7 @@ stage: Added - name: Added1065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3661\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3661\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98545,7 +98545,7 @@ stage: Added - name: Added1066 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3662\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98561,7 +98561,7 @@ stage: Added - name: Added1067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3662\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3662\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98569,7 +98569,7 @@ stage: Added - name: Added1068 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3663\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98585,7 +98585,7 @@ stage: Added - name: Added1069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3663\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3663\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98593,7 +98593,7 @@ stage: Added - name: Added1070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98601,7 +98601,7 @@ stage: Added - name: Added1071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98610,7 +98610,7 @@ stage: Added - name: Modified1072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98618,7 +98618,7 @@ stage: Modified - name: Added1073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98626,7 +98626,7 @@ stage: Added - name: Added1074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98635,7 +98635,7 @@ stage: Added - name: Modified1075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98643,7 +98643,7 @@ stage: Modified - name: Added1076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98651,7 +98651,7 @@ stage: Added - name: Added1077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98660,7 +98660,7 @@ stage: Added - name: Modified1078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98668,7 +98668,7 @@ stage: Modified - name: Added1079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98676,7 +98676,7 @@ stage: Added - name: Added1080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98685,7 +98685,7 @@ stage: Added - name: Modified1081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98693,7 +98693,7 @@ stage: Modified - name: Added1082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98701,7 +98701,7 @@ stage: Added - name: Added1083 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98709,7 +98709,7 @@ stage: Added - name: Modified1084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98717,7 +98717,7 @@ stage: Modified - name: Added1085 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98725,7 +98725,7 @@ stage: Added - name: Added1086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98733,7 +98733,7 @@ stage: Added - name: Modified1087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98741,7 +98741,7 @@ stage: Modified - name: Added1088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98749,7 +98749,7 @@ stage: Added - name: Added1089 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98757,7 +98757,7 @@ stage: Added - name: Modified1090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98765,7 +98765,7 @@ stage: Modified - name: Added1091 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98773,7 +98773,7 @@ stage: Added - name: Added1092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98781,7 +98781,7 @@ stage: Added - name: Modified1093 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -98789,7 +98789,7 @@ stage: Modified - name: Added1094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3672\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3672\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -98797,7 +98797,7 @@ stage: Added - name: Added1095 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3672\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3672\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98806,7 +98806,7 @@ stage: Added - name: Added1096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3673\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3673\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -98814,7 +98814,7 @@ stage: Added - name: Added1097 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3673\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3673\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98823,7 +98823,7 @@ stage: Added - name: Added1098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3674\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3674\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -98831,7 +98831,7 @@ stage: Added - name: Added1099 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3674\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3674\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98840,7 +98840,7 @@ stage: Added - name: Added1100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3675\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3675\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -98848,7 +98848,7 @@ stage: Added - name: Added1101 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3675\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3675\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98857,7 +98857,7 @@ stage: Added - name: Added1102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3676\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3676\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -98865,7 +98865,7 @@ stage: Added - name: Added1103 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3676\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3676\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98873,7 +98873,7 @@ stage: Added - name: Added1104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769887,"attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769887, "attributes": {"type": "registry_value", "hash_md5": "b60ed88355ac3f6898fd8a7ab1734d06", "hash_sha256": @@ -98882,14 +98882,14 @@ stage: Added - name: Added1105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769887,"attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key", "arch": "[x64]", "timestamp": 1606769887, "attributes": {"type": "registry_key", "mtime": 1606723062, "checksum": "f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}' stage: Added - name: Added1106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769888,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769888, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98897,7 +98897,7 @@ stage: Added - name: Added1107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3677\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3677\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -98905,7 +98905,7 @@ stage: Added - name: Added1108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3677\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3677\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98913,7 +98913,7 @@ stage: Added - name: Added1109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3678\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3678\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -98921,7 +98921,7 @@ stage: Added - name: Added1110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3678\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3678\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98929,7 +98929,7 @@ stage: Added - name: Added1111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3679\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3679\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -98937,7 +98937,7 @@ stage: Added - name: Added1112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3679\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3679\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -98945,7 +98945,7 @@ stage: Added - name: Added1113 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98960,7 +98960,7 @@ stage: Added - name: Added1114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -98969,7 +98969,7 @@ stage: Added - name: Modified1115 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -98988,7 +98988,7 @@ stage: Modified - name: Added1116 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99003,7 +99003,7 @@ stage: Added - name: Added1117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99012,7 +99012,7 @@ stage: Added - name: Modified1118 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99031,7 +99031,7 @@ stage: Modified - name: Added1119 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99046,7 +99046,7 @@ stage: Added - name: Added1120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99055,7 +99055,7 @@ stage: Added - name: Modified1121 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99074,7 +99074,7 @@ stage: Modified - name: Added1122 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99089,7 +99089,7 @@ stage: Added - name: Added1123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99098,7 +99098,7 @@ stage: Added - name: Modified1124 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99117,7 +99117,7 @@ stage: Modified - name: Added1125 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99132,7 +99132,7 @@ stage: Added - name: Added1126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99140,7 +99140,7 @@ stage: Added - name: Modified1127 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99159,7 +99159,7 @@ stage: Modified - name: Added1128 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99174,7 +99174,7 @@ stage: Added - name: Added1129 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99182,7 +99182,7 @@ stage: Added - name: Modified1130 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99201,7 +99201,7 @@ stage: Modified - name: Added1131 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99216,7 +99216,7 @@ stage: Added - name: Added1132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99224,7 +99224,7 @@ stage: Added - name: Modified1133 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99243,7 +99243,7 @@ stage: Modified - name: Added1134 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99258,7 +99258,7 @@ stage: Added - name: Added1135 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99266,7 +99266,7 @@ stage: Added - name: Modified1136 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99285,7 +99285,7 @@ stage: Modified - name: Added1137 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3688\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99300,7 +99300,7 @@ stage: Added - name: Added1138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3688\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3688\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99309,7 +99309,7 @@ stage: Added - name: Added1139 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3689\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99324,7 +99324,7 @@ stage: Added - name: Added1140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3689\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3689\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99333,7 +99333,7 @@ stage: Added - name: Added1141 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3690\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99348,7 +99348,7 @@ stage: Added - name: Added1142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3690\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3690\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99357,7 +99357,7 @@ stage: Added - name: Added1143 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3691\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99372,7 +99372,7 @@ stage: Added - name: Added1144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3691\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3691\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99381,7 +99381,7 @@ stage: Added - name: Added1145 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3692\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99396,7 +99396,7 @@ stage: Added - name: Added1146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3692\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3692\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99404,7 +99404,7 @@ stage: Added - name: Added1147 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3693\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99419,7 +99419,7 @@ stage: Added - name: Added1148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3693\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3693\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99427,7 +99427,7 @@ stage: Added - name: Added1149 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3694\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99442,7 +99442,7 @@ stage: Added - name: Added1150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3694\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3694\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99450,7 +99450,7 @@ stage: Added - name: Added1151 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3695\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99465,7 +99465,7 @@ stage: Added - name: Added1152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3695\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3695\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99473,14 +99473,14 @@ stage: Added - name: Added1153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added1154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99489,21 +99489,21 @@ stage: Added - name: Modified1155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added1156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added1157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99512,21 +99512,21 @@ stage: Added - name: Modified1158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added1159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added1160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99535,21 +99535,21 @@ stage: Added - name: Modified1161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added1162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added1163 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99558,21 +99558,21 @@ stage: Added - name: Modified1164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added1165 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added1166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99580,21 +99580,21 @@ stage: Added - name: Modified1167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added1168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added1169 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99602,21 +99602,21 @@ stage: Added - name: Modified1170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added1171 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added1172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99624,21 +99624,21 @@ stage: Added - name: Modified1173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added1174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Added - name: Added1175 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99646,21 +99646,21 @@ stage: Added - name: Modified1176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723064, "checksum": "85be963183184cb2765bece7c6ed4586ad84e849"}}' stage: Modified - name: Added1177 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3704\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3704\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3704\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3704\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99669,14 +99669,14 @@ stage: Added - name: Added1179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3705\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3705\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3705\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3705\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99685,14 +99685,14 @@ stage: Added - name: Added1181 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3706\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3706\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3706\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3706\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99701,14 +99701,14 @@ stage: Added - name: Added1183 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3707\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3707\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3707\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3707\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "hash_sha256": @@ -99717,14 +99717,14 @@ stage: Added - name: Added1185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3708\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3708\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3708\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3708\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99732,14 +99732,14 @@ stage: Added - name: Added1187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3709\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3709\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3709\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3709\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99747,14 +99747,14 @@ stage: Added - name: Added1189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3710\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3710\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3710\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3710\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99762,14 +99762,14 @@ stage: Added - name: Added1191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3711\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3711\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3711\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3711\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99777,7 +99777,7 @@ stage: Added - name: Added1193 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99793,7 +99793,7 @@ stage: Added - name: Added1194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99801,7 +99801,7 @@ stage: Added - name: Modified1195 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99821,7 +99821,7 @@ stage: Modified - name: Added1196 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99837,7 +99837,7 @@ stage: Added - name: Added1197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99845,7 +99845,7 @@ stage: Added - name: Modified1198 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99865,7 +99865,7 @@ stage: Modified - name: Added1199 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99881,7 +99881,7 @@ stage: Added - name: Added1200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99889,7 +99889,7 @@ stage: Added - name: Modified1201 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99909,7 +99909,7 @@ stage: Modified - name: Added1202 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99925,7 +99925,7 @@ stage: Added - name: Added1203 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99933,7 +99933,7 @@ stage: Added - name: Modified1204 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99953,7 +99953,7 @@ stage: Modified - name: Added1205 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99969,7 +99969,7 @@ stage: Added - name: Added1206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -99977,7 +99977,7 @@ stage: Added - name: Modified1207 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -99997,7 +99997,7 @@ stage: Modified - name: Added1208 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100013,7 +100013,7 @@ stage: Added - name: Added1209 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100021,7 +100021,7 @@ stage: Added - name: Modified1210 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100041,7 +100041,7 @@ stage: Modified - name: Added1211 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100057,7 +100057,7 @@ stage: Added - name: Added1212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100065,7 +100065,7 @@ stage: Added - name: Modified1213 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100085,7 +100085,7 @@ stage: Modified - name: Added1214 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100101,7 +100101,7 @@ stage: Added - name: Added1215 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100109,7 +100109,7 @@ stage: Added - name: Modified1216 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100129,7 +100129,7 @@ stage: Modified - name: Added1217 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3720\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100145,7 +100145,7 @@ stage: Added - name: Added1218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3720\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3720\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100153,7 +100153,7 @@ stage: Added - name: Added1219 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3721\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100169,7 +100169,7 @@ stage: Added - name: Added1220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3721\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3721\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100177,7 +100177,7 @@ stage: Added - name: Added1221 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3722\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100193,7 +100193,7 @@ stage: Added - name: Added1222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3722\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3722\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100201,7 +100201,7 @@ stage: Added - name: Added1223 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3723\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100217,7 +100217,7 @@ stage: Added - name: Added1224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3723\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3723\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100225,7 +100225,7 @@ stage: Added - name: Added1225 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3724\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100241,7 +100241,7 @@ stage: Added - name: Added1226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3724\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3724\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100249,7 +100249,7 @@ stage: Added - name: Added1227 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3725\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100265,7 +100265,7 @@ stage: Added - name: Added1228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3725\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3725\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100273,7 +100273,7 @@ stage: Added - name: Added1229 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3726\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100289,7 +100289,7 @@ stage: Added - name: Added1230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3726\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3726\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100297,7 +100297,7 @@ stage: Added - name: Added1231 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3727\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100313,7 +100313,7 @@ stage: Added - name: Added1232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3727\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3727\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100321,7 +100321,7 @@ stage: Added - name: Added1233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100329,7 +100329,7 @@ stage: Added - name: Added1234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100337,7 +100337,7 @@ stage: Added - name: Modified1235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100345,7 +100345,7 @@ stage: Modified - name: Added1236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100353,7 +100353,7 @@ stage: Added - name: Added1237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100361,7 +100361,7 @@ stage: Added - name: Modified1238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100369,7 +100369,7 @@ stage: Modified - name: Added1239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100377,7 +100377,7 @@ stage: Added - name: Added1240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100385,7 +100385,7 @@ stage: Added - name: Modified1241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100393,7 +100393,7 @@ stage: Modified - name: Added1242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100401,7 +100401,7 @@ stage: Added - name: Added1243 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100409,7 +100409,7 @@ stage: Added - name: Modified1244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100417,7 +100417,7 @@ stage: Modified - name: Added1245 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100425,7 +100425,7 @@ stage: Added - name: Added1246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100433,7 +100433,7 @@ stage: Added - name: Modified1247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100441,7 +100441,7 @@ stage: Modified - name: Added1248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100449,7 +100449,7 @@ stage: Added - name: Added1249 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100457,7 +100457,7 @@ stage: Added - name: Modified1250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100465,7 +100465,7 @@ stage: Modified - name: Added1251 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100473,7 +100473,7 @@ stage: Added - name: Added1252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100481,7 +100481,7 @@ stage: Added - name: Modified1253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100489,7 +100489,7 @@ stage: Modified - name: Added1254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100497,7 +100497,7 @@ stage: Added - name: Added1255 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100505,7 +100505,7 @@ stage: Added - name: Added1256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100513,7 +100513,7 @@ stage: Added - name: Added1257 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100521,7 +100521,7 @@ stage: Added - name: Added1258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100529,7 +100529,7 @@ stage: Added - name: Added1259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100537,7 +100537,7 @@ stage: Added - name: Added1260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100545,7 +100545,7 @@ stage: Added - name: Added1261 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100553,7 +100553,7 @@ stage: Added - name: Added1262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100561,7 +100561,7 @@ stage: Added - name: Added1263 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100569,7 +100569,7 @@ stage: Added - name: Added1264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100577,7 +100577,7 @@ stage: Added - name: Added1265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100585,7 +100585,7 @@ stage: Added - name: Added1266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100593,7 +100593,7 @@ stage: Added - name: Added1267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100601,7 +100601,7 @@ stage: Added - name: Added1268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -100609,7 +100609,7 @@ stage: Added - name: Added1269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100617,7 +100617,7 @@ stage: Added - name: Added1270 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100633,7 +100633,7 @@ stage: Added - name: Added1271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100641,7 +100641,7 @@ stage: Added - name: Modified1272 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100661,7 +100661,7 @@ stage: Modified - name: Added1273 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100677,7 +100677,7 @@ stage: Added - name: Added1274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100685,7 +100685,7 @@ stage: Added - name: Modified1275 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100705,7 +100705,7 @@ stage: Modified - name: Added1276 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100721,7 +100721,7 @@ stage: Added - name: Added1277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100729,7 +100729,7 @@ stage: Added - name: Modified1278 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100749,7 +100749,7 @@ stage: Modified - name: Added1279 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100765,7 +100765,7 @@ stage: Added - name: Added1280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100773,7 +100773,7 @@ stage: Added - name: Modified1281 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100793,7 +100793,7 @@ stage: Modified - name: Added1282 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100809,7 +100809,7 @@ stage: Added - name: Added1283 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100817,7 +100817,7 @@ stage: Added - name: Modified1284 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100837,7 +100837,7 @@ stage: Modified - name: Added1285 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100853,7 +100853,7 @@ stage: Added - name: Added1286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100861,7 +100861,7 @@ stage: Added - name: Modified1287 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100881,7 +100881,7 @@ stage: Modified - name: Added1288 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100897,7 +100897,7 @@ stage: Added - name: Added1289 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100905,7 +100905,7 @@ stage: Added - name: Modified1290 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100925,7 +100925,7 @@ stage: Modified - name: Added1291 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100941,7 +100941,7 @@ stage: Added - name: Added1292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100949,7 +100949,7 @@ stage: Added - name: Modified1293 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100969,7 +100969,7 @@ stage: Modified - name: Added1294 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3752\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -100984,7 +100984,7 @@ stage: Added - name: Added1295 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3752\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3752\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -100992,7 +100992,7 @@ stage: Added - name: Added1296 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3753\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101007,7 +101007,7 @@ stage: Added - name: Added1297 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3753\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3753\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101015,7 +101015,7 @@ stage: Added - name: Added1298 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3754\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101030,7 +101030,7 @@ stage: Added - name: Added1299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3754\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3754\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101038,7 +101038,7 @@ stage: Added - name: Added1300 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3755\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101053,7 +101053,7 @@ stage: Added - name: Added1301 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3755\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3755\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101061,7 +101061,7 @@ stage: Added - name: Added1302 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3756\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101076,7 +101076,7 @@ stage: Added - name: Added1303 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3756\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3756\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101084,7 +101084,7 @@ stage: Added - name: Added1304 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3757\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101099,7 +101099,7 @@ stage: Added - name: Added1305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3757\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3757\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101107,7 +101107,7 @@ stage: Added - name: Added1306 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3758\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101122,7 +101122,7 @@ stage: Added - name: Added1307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3758\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3758\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101130,7 +101130,7 @@ stage: Added - name: Added1308 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3759\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101145,7 +101145,7 @@ stage: Added - name: Added1309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3759\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3759\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101153,7 +101153,7 @@ stage: Added - name: Added1310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101161,7 +101161,7 @@ stage: Added - name: Added1311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101169,7 +101169,7 @@ stage: Added - name: Modified1312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101177,7 +101177,7 @@ stage: Modified - name: Added1313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101185,7 +101185,7 @@ stage: Added - name: Added1314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101193,7 +101193,7 @@ stage: Added - name: Modified1315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101201,7 +101201,7 @@ stage: Modified - name: Added1316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101209,7 +101209,7 @@ stage: Added - name: Added1317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101217,7 +101217,7 @@ stage: Added - name: Modified1318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101225,7 +101225,7 @@ stage: Modified - name: Added1319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101233,7 +101233,7 @@ stage: Added - name: Added1320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101241,7 +101241,7 @@ stage: Added - name: Modified1321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101249,7 +101249,7 @@ stage: Modified - name: Added1322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101257,7 +101257,7 @@ stage: Added - name: Added1323 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101265,7 +101265,7 @@ stage: Added - name: Modified1324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101273,7 +101273,7 @@ stage: Modified - name: Added1325 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101281,7 +101281,7 @@ stage: Added - name: Added1326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101289,7 +101289,7 @@ stage: Added - name: Modified1327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101297,7 +101297,7 @@ stage: Modified - name: Added1328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101305,7 +101305,7 @@ stage: Added - name: Added1329 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101313,7 +101313,7 @@ stage: Added - name: Modified1330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101321,7 +101321,7 @@ stage: Modified - name: Added1331 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101329,7 +101329,7 @@ stage: Added - name: Added1332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101337,7 +101337,7 @@ stage: Added - name: Modified1333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722888,"checksum":"a9e74f6b2c6696d16b2d9aee7c9b08c121d05853"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723065, @@ -101345,14 +101345,14 @@ stage: Modified - name: Added1334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1335 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101360,14 +101360,14 @@ stage: Added - name: Added1336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1337 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101375,14 +101375,14 @@ stage: Added - name: Added1338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101390,14 +101390,14 @@ stage: Added - name: Added1340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1341 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101405,14 +101405,14 @@ stage: Added - name: Added1342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1343 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101420,14 +101420,14 @@ stage: Added - name: Added1344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101435,14 +101435,14 @@ stage: Added - name: Added1346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101450,14 +101450,14 @@ stage: Added - name: Added1348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101465,7 +101465,7 @@ stage: Added - name: Added1350 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101481,7 +101481,7 @@ stage: Added - name: Modified1351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"bdb462d2b1a377da2b96e634c87da0f9e2fd1e13"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -101489,7 +101489,7 @@ stage: Modified - name: Modified1352 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101509,7 +101509,7 @@ stage: Modified - name: Added1353 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101525,7 +101525,7 @@ stage: Added - name: Added1354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101533,7 +101533,7 @@ stage: Added - name: Modified1355 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101553,7 +101553,7 @@ stage: Modified - name: Added1356 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101569,7 +101569,7 @@ stage: Added - name: Added1357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101577,7 +101577,7 @@ stage: Added - name: Modified1358 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101597,7 +101597,7 @@ stage: Modified - name: Added1359 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101613,7 +101613,7 @@ stage: Added - name: Added1360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101621,7 +101621,7 @@ stage: Added - name: Modified1361 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101641,7 +101641,7 @@ stage: Modified - name: Added1362 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101657,7 +101657,7 @@ stage: Added - name: Added1363 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101665,7 +101665,7 @@ stage: Added - name: Modified1364 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101685,7 +101685,7 @@ stage: Modified - name: Added1365 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101701,7 +101701,7 @@ stage: Added - name: Added1366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101709,7 +101709,7 @@ stage: Added - name: Modified1367 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101729,7 +101729,7 @@ stage: Modified - name: Added1368 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101745,7 +101745,7 @@ stage: Added - name: Added1369 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101753,7 +101753,7 @@ stage: Added - name: Modified1370 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101773,7 +101773,7 @@ stage: Modified - name: Added1371 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101789,7 +101789,7 @@ stage: Added - name: Added1372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101797,7 +101797,7 @@ stage: Added - name: Modified1373 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101817,7 +101817,7 @@ stage: Modified - name: Added1374 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3784\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101833,7 +101833,7 @@ stage: Added - name: Added1375 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3784\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3784\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101841,7 +101841,7 @@ stage: Added - name: Added1376 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3785\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101857,7 +101857,7 @@ stage: Added - name: Added1377 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3785\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3785\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101865,7 +101865,7 @@ stage: Added - name: Added1378 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3786\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101881,7 +101881,7 @@ stage: Added - name: Added1379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3786\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3786\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101889,7 +101889,7 @@ stage: Added - name: Added1380 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3787\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101905,7 +101905,7 @@ stage: Added - name: Added1381 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3787\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3787\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101913,7 +101913,7 @@ stage: Added - name: Added1382 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3788\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101929,7 +101929,7 @@ stage: Added - name: Added1383 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3788\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3788\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101937,7 +101937,7 @@ stage: Added - name: Added1384 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3789\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101953,7 +101953,7 @@ stage: Added - name: Added1385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3789\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3789\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101961,7 +101961,7 @@ stage: Added - name: Added1386 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3790\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -101977,7 +101977,7 @@ stage: Added - name: Added1387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3790\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3790\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -101985,7 +101985,7 @@ stage: Added - name: Added1388 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3791\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102001,7 +102001,7 @@ stage: Added - name: Added1389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3791\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3791\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102009,7 +102009,7 @@ stage: Added - name: Added1390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102017,7 +102017,7 @@ stage: Added - name: Added1391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102025,7 +102025,7 @@ stage: Added - name: Modified1392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102033,7 +102033,7 @@ stage: Modified - name: Added1393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102041,7 +102041,7 @@ stage: Added - name: Added1394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102049,7 +102049,7 @@ stage: Added - name: Modified1395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102057,7 +102057,7 @@ stage: Modified - name: Added1396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102065,7 +102065,7 @@ stage: Added - name: Added1397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102073,7 +102073,7 @@ stage: Added - name: Modified1398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102081,7 +102081,7 @@ stage: Modified - name: Added1399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102089,7 +102089,7 @@ stage: Added - name: Added1400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102097,7 +102097,7 @@ stage: Added - name: Modified1401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102105,7 +102105,7 @@ stage: Modified - name: Added1402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102113,7 +102113,7 @@ stage: Added - name: Added1403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102121,7 +102121,7 @@ stage: Added - name: Modified1404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102129,7 +102129,7 @@ stage: Modified - name: Added1405 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102137,7 +102137,7 @@ stage: Added - name: Added1406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102145,7 +102145,7 @@ stage: Added - name: Modified1407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102153,7 +102153,7 @@ stage: Modified - name: Added1408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102161,7 +102161,7 @@ stage: Added - name: Added1409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102169,7 +102169,7 @@ stage: Added - name: Modified1410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102177,7 +102177,7 @@ stage: Modified - name: Added1411 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102185,7 +102185,7 @@ stage: Added - name: Added1412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102193,7 +102193,7 @@ stage: Added - name: Modified1413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722888,"checksum":"187208ab516a5bebf13796915667a8ae4d652883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -102201,7 +102201,7 @@ stage: Modified - name: Added1414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3800\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3800\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -102209,7 +102209,7 @@ stage: Added - name: Added1415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3800\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3800\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102217,7 +102217,7 @@ stage: Added - name: Added1416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3801\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3801\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -102225,7 +102225,7 @@ stage: Added - name: Added1417 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3801\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3801\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102233,7 +102233,7 @@ stage: Added - name: Added1418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3802\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3802\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -102241,7 +102241,7 @@ stage: Added - name: Added1419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3802\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3802\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102249,7 +102249,7 @@ stage: Added - name: Added1420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3803\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3803\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -102257,7 +102257,7 @@ stage: Added - name: Added1421 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3803\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3803\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102265,7 +102265,7 @@ stage: Added - name: Added1422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3804\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3804\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -102273,7 +102273,7 @@ stage: Added - name: Added1423 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3804\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3804\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102281,7 +102281,7 @@ stage: Added - name: Added1424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3805\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3805\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -102289,7 +102289,7 @@ stage: Added - name: Added1425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3805\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3805\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102297,7 +102297,7 @@ stage: Added - name: Added1426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3806\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3806\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -102305,7 +102305,7 @@ stage: Added - name: Added1427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3806\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3806\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102313,7 +102313,7 @@ stage: Added - name: Added1428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3807\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3807\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -102321,7 +102321,7 @@ stage: Added - name: Added1429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3807\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3807\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102329,7 +102329,7 @@ stage: Added - name: Added1430 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102344,7 +102344,7 @@ stage: Added - name: Added1431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102352,7 +102352,7 @@ stage: Added - name: Modified1432 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102371,7 +102371,7 @@ stage: Modified - name: Added1433 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102386,7 +102386,7 @@ stage: Added - name: Added1434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102394,7 +102394,7 @@ stage: Added - name: Modified1435 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102413,7 +102413,7 @@ stage: Modified - name: Added1436 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102428,7 +102428,7 @@ stage: Added - name: Added1437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102436,7 +102436,7 @@ stage: Added - name: Modified1438 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102455,7 +102455,7 @@ stage: Modified - name: Added1439 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102470,7 +102470,7 @@ stage: Added - name: Added1440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102478,7 +102478,7 @@ stage: Added - name: Modified1441 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102497,7 +102497,7 @@ stage: Modified - name: Added1442 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102512,7 +102512,7 @@ stage: Added - name: Added1443 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102520,7 +102520,7 @@ stage: Added - name: Modified1444 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102539,7 +102539,7 @@ stage: Modified - name: Added1445 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102554,7 +102554,7 @@ stage: Added - name: Added1446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102562,7 +102562,7 @@ stage: Added - name: Modified1447 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102581,7 +102581,7 @@ stage: Modified - name: Added1448 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102596,7 +102596,7 @@ stage: Added - name: Added1449 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102604,7 +102604,7 @@ stage: Added - name: Modified1450 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102623,7 +102623,7 @@ stage: Modified - name: Added1451 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102638,7 +102638,7 @@ stage: Added - name: Added1452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102646,7 +102646,7 @@ stage: Added - name: Modified1453 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102665,7 +102665,7 @@ stage: Modified - name: Added1454 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3816\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102680,7 +102680,7 @@ stage: Added - name: Added1455 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3816\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3816\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102688,7 +102688,7 @@ stage: Added - name: Added1456 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3817\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102703,7 +102703,7 @@ stage: Added - name: Added1457 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3817\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3817\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102711,7 +102711,7 @@ stage: Added - name: Added1458 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3818\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102726,7 +102726,7 @@ stage: Added - name: Added1459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3818\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3818\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102734,7 +102734,7 @@ stage: Added - name: Added1460 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3819\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102749,7 +102749,7 @@ stage: Added - name: Added1461 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3819\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3819\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102757,7 +102757,7 @@ stage: Added - name: Added1462 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3820\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102772,7 +102772,7 @@ stage: Added - name: Added1463 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3820\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3820\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102780,7 +102780,7 @@ stage: Added - name: Added1464 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3821\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102795,7 +102795,7 @@ stage: Added - name: Added1465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3821\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3821\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102803,7 +102803,7 @@ stage: Added - name: Added1466 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3822\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102818,7 +102818,7 @@ stage: Added - name: Added1467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3822\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3822\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102826,7 +102826,7 @@ stage: Added - name: Added1468 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3823\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -102841,7 +102841,7 @@ stage: Added - name: Added1469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3823\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3823\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102849,14 +102849,14 @@ stage: Added - name: Added1470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Added - name: Added1471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102864,21 +102864,21 @@ stage: Added - name: Modified1472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Modified - name: Added1473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Added - name: Added1474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102886,21 +102886,21 @@ stage: Added - name: Modified1475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Modified - name: Added1476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Added - name: Added1477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102908,21 +102908,21 @@ stage: Added - name: Modified1478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Modified - name: Added1479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Added - name: Added1480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102930,21 +102930,21 @@ stage: Added - name: Modified1481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Modified - name: Added1482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Added - name: Added1483 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102952,21 +102952,21 @@ stage: Added - name: Modified1484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Modified - name: Added1485 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Added - name: Added1486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102974,21 +102974,21 @@ stage: Added - name: Modified1487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Modified - name: Added1488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Added - name: Added1489 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -102996,21 +102996,21 @@ stage: Added - name: Modified1490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Modified - name: Added1491 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Added - name: Added1492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -103018,21 +103018,21 @@ stage: Added - name: Modified1493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722888,"checksum":"5dfa1eccd14466c595ff0c374543541ce8e89144"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "mtime": 1606723065, "checksum": "a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}' stage: Modified - name: Added1494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3832\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3832\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1495 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3832\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3832\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -103040,14 +103040,14 @@ stage: Added - name: Added1496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3833\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3833\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1497 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3833\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3833\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -103055,14 +103055,14 @@ stage: Added - name: Added1498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3834\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3834\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3834\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3834\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -103070,14 +103070,14 @@ stage: Added - name: Added1500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3835\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3835\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1501 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3835\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3835\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -103085,14 +103085,14 @@ stage: Added - name: Added1502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3836\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3836\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1503 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3836\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3836\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -103100,14 +103100,14 @@ stage: Added - name: Added1504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3837\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3837\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3837\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3837\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -103115,14 +103115,14 @@ stage: Added - name: Added1506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3838\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3838\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3838\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3838\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -103130,14 +103130,14 @@ stage: Added - name: Added1508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3839\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3839\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3839\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3839\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -103145,7 +103145,7 @@ stage: Added - name: Added1510 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103161,14 +103161,14 @@ stage: Added - name: Added1511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1512 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103188,7 +103188,7 @@ stage: Modified - name: Added1513 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103204,14 +103204,14 @@ stage: Added - name: Added1514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1515 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103231,7 +103231,7 @@ stage: Modified - name: Added1516 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103247,14 +103247,14 @@ stage: Added - name: Added1517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1518 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103274,7 +103274,7 @@ stage: Modified - name: Added1519 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103290,14 +103290,14 @@ stage: Added - name: Added1520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1521 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103317,7 +103317,7 @@ stage: Modified - name: Added1522 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103333,14 +103333,14 @@ stage: Added - name: Added1523 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1524 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103360,7 +103360,7 @@ stage: Modified - name: Added1525 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103376,14 +103376,14 @@ stage: Added - name: Added1526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1527 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103403,7 +103403,7 @@ stage: Modified - name: Added1528 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103419,14 +103419,14 @@ stage: Added - name: Added1529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1530 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103446,7 +103446,7 @@ stage: Modified - name: Added1531 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103462,14 +103462,14 @@ stage: Added - name: Added1532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1533 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103489,7 +103489,7 @@ stage: Modified - name: Added1534 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3848\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103505,14 +103505,14 @@ stage: Added - name: Added1535 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3848\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3848\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1536 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3849\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103528,14 +103528,14 @@ stage: Added - name: Added1537 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3849\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3849\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1538 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3850\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103551,14 +103551,14 @@ stage: Added - name: Added1539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3850\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3850\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1540 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3851\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103574,14 +103574,14 @@ stage: Added - name: Added1541 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3851\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3851\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1542 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3852\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103597,14 +103597,14 @@ stage: Added - name: Added1543 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3852\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3852\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1544 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3853\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103620,14 +103620,14 @@ stage: Added - name: Added1545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3853\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3853\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1546 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3854\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103643,7 +103643,7 @@ stage: Added - name: Added1547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -103651,7 +103651,7 @@ stage: Added - name: Added1548 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3855\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103667,14 +103667,14 @@ stage: Added - name: Added1549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3855\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3855\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103682,14 +103682,14 @@ stage: Added - name: Added1551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103697,7 +103697,7 @@ stage: Modified - name: Added1553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103705,14 +103705,14 @@ stage: Added - name: Added1554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103720,7 +103720,7 @@ stage: Modified - name: Added1556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103728,14 +103728,14 @@ stage: Added - name: Added1557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103743,7 +103743,7 @@ stage: Modified - name: Added1559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103751,14 +103751,14 @@ stage: Added - name: Added1560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103766,7 +103766,7 @@ stage: Modified - name: Added1562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103774,14 +103774,14 @@ stage: Added - name: Added1563 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103789,7 +103789,7 @@ stage: Modified - name: Added1565 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103797,14 +103797,14 @@ stage: Added - name: Added1566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103812,7 +103812,7 @@ stage: Modified - name: Added1568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103820,14 +103820,14 @@ stage: Added - name: Added1569 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103835,7 +103835,7 @@ stage: Modified - name: Added1571 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103843,14 +103843,14 @@ stage: Added - name: Added1572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103858,7 +103858,7 @@ stage: Modified - name: Added1574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103866,14 +103866,14 @@ stage: Added - name: Added1575 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103881,14 +103881,14 @@ stage: Added - name: Added1577 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103896,14 +103896,14 @@ stage: Added - name: Added1579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103911,14 +103911,14 @@ stage: Added - name: Added1581 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103926,14 +103926,14 @@ stage: Added - name: Added1583 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103941,14 +103941,14 @@ stage: Added - name: Added1585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103956,14 +103956,14 @@ stage: Added - name: Added1587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -103971,14 +103971,14 @@ stage: Added - name: Added1589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1590 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -103994,14 +103994,14 @@ stage: Added - name: Added1591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1592 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104021,7 +104021,7 @@ stage: Modified - name: Added1593 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104037,14 +104037,14 @@ stage: Added - name: Added1594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1595 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104064,7 +104064,7 @@ stage: Modified - name: Added1596 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104080,14 +104080,14 @@ stage: Added - name: Added1597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1598 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104107,7 +104107,7 @@ stage: Modified - name: Added1599 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104123,14 +104123,14 @@ stage: Added - name: Added1600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1601 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104150,7 +104150,7 @@ stage: Modified - name: Added1602 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104166,14 +104166,14 @@ stage: Added - name: Added1603 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1604 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104193,7 +104193,7 @@ stage: Modified - name: Added1605 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104209,14 +104209,14 @@ stage: Added - name: Added1606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1607 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104236,7 +104236,7 @@ stage: Modified - name: Added1608 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104252,14 +104252,14 @@ stage: Added - name: Added1609 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1610 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104279,7 +104279,7 @@ stage: Modified - name: Added1611 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104295,14 +104295,14 @@ stage: Added - name: Added1612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1613 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104322,7 +104322,7 @@ stage: Modified - name: Added1614 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3880\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104337,14 +104337,14 @@ stage: Added - name: Added1615 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3880\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3880\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1616 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3881\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104359,14 +104359,14 @@ stage: Added - name: Added1617 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3881\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3881\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1618 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3882\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104381,14 +104381,14 @@ stage: Added - name: Added1619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3882\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3882\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1620 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3883\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104403,14 +104403,14 @@ stage: Added - name: Added1621 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3883\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3883\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1622 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3884\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104425,14 +104425,14 @@ stage: Added - name: Added1623 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3884\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3884\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1624 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3885\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104447,14 +104447,14 @@ stage: Added - name: Added1625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3885\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3885\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1626 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3886\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104469,14 +104469,14 @@ stage: Added - name: Added1627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3886\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3886\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1628 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3887\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104491,14 +104491,14 @@ stage: Added - name: Added1629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3887\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3887\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104506,14 +104506,14 @@ stage: Added - name: Added1631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104521,7 +104521,7 @@ stage: Modified - name: Added1633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104529,14 +104529,14 @@ stage: Added - name: Added1634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104544,7 +104544,7 @@ stage: Modified - name: Added1636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104552,14 +104552,14 @@ stage: Added - name: Added1637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104567,7 +104567,7 @@ stage: Modified - name: Added1639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104575,14 +104575,14 @@ stage: Added - name: Added1640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104590,7 +104590,7 @@ stage: Modified - name: Added1642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104598,14 +104598,14 @@ stage: Added - name: Added1643 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104613,7 +104613,7 @@ stage: Modified - name: Added1645 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104621,14 +104621,14 @@ stage: Added - name: Added1646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104636,7 +104636,7 @@ stage: Modified - name: Added1648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104644,14 +104644,14 @@ stage: Added - name: Added1649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104659,7 +104659,7 @@ stage: Modified - name: Added1651 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104667,14 +104667,14 @@ stage: Added - name: Added1652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -104682,119 +104682,119 @@ stage: Modified - name: Added1654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3854\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3854\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1657 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1661 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1663 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1670 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104810,14 +104810,14 @@ stage: Added - name: Added1671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1672 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104837,7 +104837,7 @@ stage: Modified - name: Added1673 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104853,14 +104853,14 @@ stage: Added - name: Added1674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1675 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104880,7 +104880,7 @@ stage: Modified - name: Added1676 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104896,14 +104896,14 @@ stage: Added - name: Added1677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1678 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104923,7 +104923,7 @@ stage: Modified - name: Added1679 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104939,14 +104939,14 @@ stage: Added - name: Added1680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1681 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104966,7 +104966,7 @@ stage: Modified - name: Added1682 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -104982,14 +104982,14 @@ stage: Added - name: Added1683 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1684 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105009,7 +105009,7 @@ stage: Modified - name: Added1685 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105025,7 +105025,7 @@ stage: Added - name: Added1686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769889,"attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769889, "attributes": {"type": "registry_value", "hash_sha256": "279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061", @@ -105033,7 +105033,7 @@ stage: Added - name: Added1687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -105041,21 +105041,21 @@ stage: Added - name: Added1688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769889,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key", "arch": "[x64]", "timestamp": 1606769889, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1690 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105075,7 +105075,7 @@ stage: Modified - name: Added1691 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105091,14 +105091,14 @@ stage: Added - name: Added1692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1693 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105118,7 +105118,7 @@ stage: Modified - name: Added1694 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105134,14 +105134,14 @@ stage: Added - name: Added1695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1696 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105161,7 +105161,7 @@ stage: Modified - name: Added1697 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3912\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105177,14 +105177,14 @@ stage: Added - name: Added1698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3912\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3912\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1699 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3913\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105200,14 +105200,14 @@ stage: Added - name: Added1700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3913\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3913\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1701 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3914\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105223,14 +105223,14 @@ stage: Added - name: Added1702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3914\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3914\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1703 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3915\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105246,14 +105246,14 @@ stage: Added - name: Added1704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3915\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3915\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1705 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3916\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105269,14 +105269,14 @@ stage: Added - name: Added1706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3916\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3916\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1707 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3917\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105292,14 +105292,14 @@ stage: Added - name: Added1708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3917\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3917\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1709 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3918\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105315,14 +105315,14 @@ stage: Added - name: Added1710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3918\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3918\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1711 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3919\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105338,14 +105338,14 @@ stage: Added - name: Added1712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3919\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3919\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105353,14 +105353,14 @@ stage: Added - name: Added1714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105368,7 +105368,7 @@ stage: Modified - name: Added1716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105376,14 +105376,14 @@ stage: Added - name: Added1717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105391,7 +105391,7 @@ stage: Modified - name: Added1719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105399,14 +105399,14 @@ stage: Added - name: Added1720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105414,7 +105414,7 @@ stage: Modified - name: Added1722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105422,14 +105422,14 @@ stage: Added - name: Added1723 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105437,7 +105437,7 @@ stage: Modified - name: Added1725 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105445,14 +105445,14 @@ stage: Added - name: Added1726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105460,7 +105460,7 @@ stage: Modified - name: Added1728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105468,14 +105468,14 @@ stage: Added - name: Added1729 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105483,7 +105483,7 @@ stage: Modified - name: Added1731 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105491,14 +105491,14 @@ stage: Added - name: Added1732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105506,7 +105506,7 @@ stage: Modified - name: Added1734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105514,14 +105514,14 @@ stage: Added - name: Added1735 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -105529,7 +105529,7 @@ stage: Modified - name: Added1737 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3928\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3928\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -105537,14 +105537,14 @@ stage: Added - name: Added1738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3928\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3928\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3929\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3929\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -105552,14 +105552,14 @@ stage: Added - name: Added1740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3929\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3929\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1741 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3930\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3930\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -105567,14 +105567,14 @@ stage: Added - name: Added1742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3930\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3930\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1743 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3931\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3931\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -105582,14 +105582,14 @@ stage: Added - name: Added1744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3931\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3931\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3932\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3932\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -105597,14 +105597,14 @@ stage: Added - name: Added1746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3932\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3932\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3933\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3933\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -105612,14 +105612,14 @@ stage: Added - name: Added1748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3933\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3933\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3934\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3934\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -105627,14 +105627,14 @@ stage: Added - name: Added1750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3934\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3934\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3935\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3935\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -105642,14 +105642,14 @@ stage: Added - name: Added1752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3935\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3935\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1753 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105664,14 +105664,14 @@ stage: Added - name: Added1754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1755 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105690,7 +105690,7 @@ stage: Modified - name: Added1756 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105705,14 +105705,14 @@ stage: Added - name: Added1757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1758 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105731,7 +105731,7 @@ stage: Modified - name: Added1759 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105746,14 +105746,14 @@ stage: Added - name: Added1760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1761 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105772,7 +105772,7 @@ stage: Modified - name: Added1762 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105787,14 +105787,14 @@ stage: Added - name: Added1763 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1764 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105813,7 +105813,7 @@ stage: Modified - name: Added1765 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105828,14 +105828,14 @@ stage: Added - name: Added1766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1767 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105854,7 +105854,7 @@ stage: Modified - name: Added1768 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105869,14 +105869,14 @@ stage: Added - name: Added1769 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1770 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105895,7 +105895,7 @@ stage: Modified - name: Added1771 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105910,14 +105910,14 @@ stage: Added - name: Added1772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1773 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105936,7 +105936,7 @@ stage: Modified - name: Added1774 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105951,14 +105951,14 @@ stage: Added - name: Added1775 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1776 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105977,7 +105977,7 @@ stage: Modified - name: Added1777 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3944\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -105992,14 +105992,14 @@ stage: Added - name: Added1778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3944\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3944\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1779 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3945\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106014,14 +106014,14 @@ stage: Added - name: Added1780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3945\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3945\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1781 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3946\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106036,14 +106036,14 @@ stage: Added - name: Added1782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3946\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3946\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1783 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3947\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106058,14 +106058,14 @@ stage: Added - name: Added1784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3947\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3947\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1785 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3948\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106080,14 +106080,14 @@ stage: Added - name: Added1786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3948\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3948\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1787 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3949\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106102,14 +106102,14 @@ stage: Added - name: Added1788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3949\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3949\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1789 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3950\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106124,14 +106124,14 @@ stage: Added - name: Added1790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3950\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3950\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1791 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3951\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106146,294 +106146,294 @@ stage: Added - name: Added1792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3951\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3951\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Added - name: Added1794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Modified - name: Added1796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Added - name: Added1797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Modified - name: Added1799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Added - name: Added1800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Modified - name: Added1802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Added - name: Added1803 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Modified - name: Added1805 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Added - name: Added1806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Modified - name: Added1808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Added - name: Added1809 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Modified - name: Added1811 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Added - name: Added1812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Modified - name: Added1814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Added - name: Added1815 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "mtime": 1606723066, "checksum": "fc863fa3681a001c753de9d6de0877cd19165acd"}}' stage: Modified - name: Added1817 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3960\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3960\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3960\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3960\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3961\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3961\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3961\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3961\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1821 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3962\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3962\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3962\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3962\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1823 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3963\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3963\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3963\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3963\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3964\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3964\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3964\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3964\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3965\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3965\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3965\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3965\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3966\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3966\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3966\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3966\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3967\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3967\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added1832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3967\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3967\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "size": 6, "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1833 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3968\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106449,14 +106449,14 @@ stage: Added - name: Added1834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3968\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3968\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1835 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3968","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3968","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106476,7 +106476,7 @@ stage: Modified - name: Added1836 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3969\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106492,14 +106492,14 @@ stage: Added - name: Added1837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3969\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3969\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1838 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3969","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3969","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106519,7 +106519,7 @@ stage: Modified - name: Added1839 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3970\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106535,14 +106535,14 @@ stage: Added - name: Added1840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3970\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3970\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1841 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3970","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3970","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106562,7 +106562,7 @@ stage: Modified - name: Added1842 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3971\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106578,14 +106578,14 @@ stage: Added - name: Added1843 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3971\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3971\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1844 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3971","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3971","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106605,7 +106605,7 @@ stage: Modified - name: Added1845 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3972\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106621,14 +106621,14 @@ stage: Added - name: Added1846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3972\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3972\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1847 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3972","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3972","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106648,7 +106648,7 @@ stage: Modified - name: Added1848 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3973\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106664,14 +106664,14 @@ stage: Added - name: Added1849 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3973\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3973\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1850 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3973","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3973","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106691,7 +106691,7 @@ stage: Modified - name: Added1851 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3974\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106707,14 +106707,14 @@ stage: Added - name: Added1852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3974\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3974\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1853 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3974","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3974","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106734,7 +106734,7 @@ stage: Modified - name: Added1854 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3975\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106750,14 +106750,14 @@ stage: Added - name: Added1855 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3975\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3975\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1856 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3975","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3975","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106777,7 +106777,7 @@ stage: Modified - name: Added1857 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3976\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106793,14 +106793,14 @@ stage: Added - name: Added1858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3976\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3976\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1859 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3977\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106816,14 +106816,14 @@ stage: Added - name: Added1860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3977\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3977\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1861 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3978\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106839,14 +106839,14 @@ stage: Added - name: Added1862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3978\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3978\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1863 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3979\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106862,14 +106862,14 @@ stage: Added - name: Added1864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3979\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3979\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1865 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3980\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106885,14 +106885,14 @@ stage: Added - name: Added1866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3980\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3980\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1867 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3981\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106908,14 +106908,14 @@ stage: Added - name: Added1868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3981\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3981\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1869 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3982\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106931,14 +106931,14 @@ stage: Added - name: Added1870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3982\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3982\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1871 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3983\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -106954,14 +106954,14 @@ stage: Added - name: Added1872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3983\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3983\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -106969,14 +106969,14 @@ stage: Added - name: Added1874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -106984,7 +106984,7 @@ stage: Modified - name: Added1876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -106992,14 +106992,14 @@ stage: Added - name: Added1877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107007,7 +107007,7 @@ stage: Modified - name: Added1879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107015,14 +107015,14 @@ stage: Added - name: Added1880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107030,7 +107030,7 @@ stage: Modified - name: Added1882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107038,14 +107038,14 @@ stage: Added - name: Added1883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107053,7 +107053,7 @@ stage: Modified - name: Added1885 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107061,14 +107061,14 @@ stage: Added - name: Added1886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107076,7 +107076,7 @@ stage: Modified - name: Added1888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107084,14 +107084,14 @@ stage: Added - name: Added1889 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107099,7 +107099,7 @@ stage: Modified - name: Added1891 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107107,14 +107107,14 @@ stage: Added - name: Added1892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107122,7 +107122,7 @@ stage: Modified - name: Added1894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107130,14 +107130,14 @@ stage: Added - name: Added1895 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"fbadb17d200b089bb4dfc4221d56434bc6c7cd7f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107145,7 +107145,7 @@ stage: Modified - name: Added1897 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3992\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3992\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107153,14 +107153,14 @@ stage: Added - name: Added1898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3992\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3992\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3993\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3993\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107168,14 +107168,14 @@ stage: Added - name: Added1900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3993\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3993\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1901 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3994\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3994\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107183,14 +107183,14 @@ stage: Added - name: Added1902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3994\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3994\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1903 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3995\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3995\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107198,14 +107198,14 @@ stage: Added - name: Added1904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3995\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3995\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3996\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3996\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107213,14 +107213,14 @@ stage: Added - name: Added1906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3996\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3996\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3997\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3997\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107228,14 +107228,14 @@ stage: Added - name: Added1908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3997\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3997\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3998\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3998\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107243,14 +107243,14 @@ stage: Added - name: Added1910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3998\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3998\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3999\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3999\\reg_key", "arch": "[x64]", "timestamp": 1606769890, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -107258,14 +107258,14 @@ stage: Added - name: Added1912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3999\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3999\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1913 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4000\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107281,14 +107281,14 @@ stage: Added - name: Added1914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4000\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4000\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1915 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4000","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4000","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107308,7 +107308,7 @@ stage: Modified - name: Added1916 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4001\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107324,14 +107324,14 @@ stage: Added - name: Added1917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4001\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4001\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1918 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4001","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4001","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107351,7 +107351,7 @@ stage: Modified - name: Added1919 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4002\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107367,14 +107367,14 @@ stage: Added - name: Added1920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4002\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4002\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1921 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4002","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4002","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107394,7 +107394,7 @@ stage: Modified - name: Added1922 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4003\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107410,14 +107410,14 @@ stage: Added - name: Added1923 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4003\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4003\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1924 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4003","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4003","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107437,7 +107437,7 @@ stage: Modified - name: Added1925 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4004\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107453,14 +107453,14 @@ stage: Added - name: Added1926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4004\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4004\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1927 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4004","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4004","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107480,7 +107480,7 @@ stage: Modified - name: Added1928 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4005\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107496,14 +107496,14 @@ stage: Added - name: Added1929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4005\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4005\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1930 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4005","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4005","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107523,7 +107523,7 @@ stage: Modified - name: Added1931 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4006\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107539,14 +107539,14 @@ stage: Added - name: Added1932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4006\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4006\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1933 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4006","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4006","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107566,7 +107566,7 @@ stage: Modified - name: Added1934 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4007\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107582,14 +107582,14 @@ stage: Added - name: Added1935 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4007\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4007\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1936 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4007","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4007","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107609,7 +107609,7 @@ stage: Modified - name: Added1937 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4008\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769890,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107624,14 +107624,14 @@ stage: Added - name: Added1938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4008\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769890,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4008\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1939 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4009\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107646,14 +107646,14 @@ stage: Added - name: Added1940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4009\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4009\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1941 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4010\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107668,14 +107668,14 @@ stage: Added - name: Added1942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4010\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4010\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1943 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4011\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107690,14 +107690,14 @@ stage: Added - name: Added1944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4011\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4011\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1945 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4012\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107712,14 +107712,14 @@ stage: Added - name: Added1946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4012\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4012\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1947 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4013\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107734,14 +107734,14 @@ stage: Added - name: Added1948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4013\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4013\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1949 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4014\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107756,14 +107756,14 @@ stage: Added - name: Added1950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4014\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4014\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1951 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4015\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -107778,14 +107778,14 @@ stage: Added - name: Added1952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4015\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4015\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107793,14 +107793,14 @@ stage: Added - name: Added1954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107808,7 +107808,7 @@ stage: Modified - name: Added1956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107816,14 +107816,14 @@ stage: Added - name: Added1957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107831,7 +107831,7 @@ stage: Modified - name: Added1959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107839,14 +107839,14 @@ stage: Added - name: Added1960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107854,7 +107854,7 @@ stage: Modified - name: Added1962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107862,14 +107862,14 @@ stage: Added - name: Added1963 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107877,7 +107877,7 @@ stage: Modified - name: Added1965 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107885,14 +107885,14 @@ stage: Added - name: Added1966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107900,7 +107900,7 @@ stage: Modified - name: Added1968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107908,14 +107908,14 @@ stage: Added - name: Added1969 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107923,7 +107923,7 @@ stage: Modified - name: Added1971 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107931,14 +107931,14 @@ stage: Added - name: Added1972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107946,7 +107946,7 @@ stage: Modified - name: Added1974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107954,14 +107954,14 @@ stage: Added - name: Added1975 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606722889,"checksum":"0d97c94973d8aa6ea79eb74a899de8ddf8a42e47"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606723066, @@ -107969,119 +107969,119 @@ stage: Modified - name: Added1977 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4024\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4024\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4024\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4024\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4025\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4025\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4025\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4025\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1981 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4026\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4026\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4026\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4026\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1983 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4027\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4027\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4027\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4027\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4028\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4028\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4028\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4028\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4029\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4029\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4029\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4029\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4030\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4030\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4030\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4030\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4031\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4031\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "checksum": "2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}' stage: Added - name: Added1992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4031\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4031\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added1993 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4032\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108097,14 +108097,14 @@ stage: Added - name: Added1994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4032\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4032\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1995 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4032","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4032","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108124,7 +108124,7 @@ stage: Modified - name: Added1996 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4033\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108140,14 +108140,14 @@ stage: Added - name: Added1997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4033\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4033\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified1998 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4033","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4033","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108167,7 +108167,7 @@ stage: Modified - name: Added1999 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4034\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108183,14 +108183,14 @@ stage: Added - name: Added2000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4034\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4034\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2001 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4034","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4034","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108210,7 +108210,7 @@ stage: Modified - name: Added2002 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4035\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108226,14 +108226,14 @@ stage: Added - name: Added2003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4035\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4035\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2004 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4035","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4035","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108253,7 +108253,7 @@ stage: Modified - name: Added2005 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4036\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108269,14 +108269,14 @@ stage: Added - name: Added2006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4036\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4036\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2007 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4036","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4036","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108296,7 +108296,7 @@ stage: Modified - name: Added2008 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4037\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108312,14 +108312,14 @@ stage: Added - name: Added2009 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4037\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4037\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2010 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4037","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4037","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108339,7 +108339,7 @@ stage: Modified - name: Added2011 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4038\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108355,14 +108355,14 @@ stage: Added - name: Added2012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4038\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4038\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2013 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4038","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4038","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108382,7 +108382,7 @@ stage: Modified - name: Added2014 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4039\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108398,14 +108398,14 @@ stage: Added - name: Added2015 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4039\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4039\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2016 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4039","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4039","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108425,7 +108425,7 @@ stage: Modified - name: Added2017 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4040\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108441,14 +108441,14 @@ stage: Added - name: Added2018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4040\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4040\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2019 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4041\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108464,14 +108464,14 @@ stage: Added - name: Added2020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4041\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4041\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2021 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4042\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108487,14 +108487,14 @@ stage: Added - name: Added2022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4042\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4042\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2023 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4043\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108510,14 +108510,14 @@ stage: Added - name: Added2024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4043\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4043\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2025 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4044\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108533,14 +108533,14 @@ stage: Added - name: Added2026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4044\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4044\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2027 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4045\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108556,14 +108556,14 @@ stage: Added - name: Added2028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4045\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4045\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2029 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4046\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108579,14 +108579,14 @@ stage: Added - name: Added2030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4046\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4046\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2031 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4047\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108602,14 +108602,14 @@ stage: Added - name: Added2032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4047\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4047\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108617,14 +108617,14 @@ stage: Added - name: Added2034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108632,7 +108632,7 @@ stage: Modified - name: Added2036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108640,14 +108640,14 @@ stage: Added - name: Added2037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108655,7 +108655,7 @@ stage: Modified - name: Added2039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108663,14 +108663,14 @@ stage: Added - name: Added2040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108678,7 +108678,7 @@ stage: Modified - name: Added2042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108686,14 +108686,14 @@ stage: Added - name: Added2043 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108701,7 +108701,7 @@ stage: Modified - name: Added2045 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108709,14 +108709,14 @@ stage: Added - name: Added2046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108724,7 +108724,7 @@ stage: Modified - name: Added2048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108732,14 +108732,14 @@ stage: Added - name: Added2049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108747,7 +108747,7 @@ stage: Modified - name: Added2051 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108755,14 +108755,14 @@ stage: Added - name: Added2052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108770,7 +108770,7 @@ stage: Modified - name: Added2054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108778,14 +108778,14 @@ stage: Added - name: Added2055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606722889,"checksum":"c66e531e9235823754fb8343875f7007cd6be181"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -108793,7 +108793,7 @@ stage: Modified - name: Added2057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4056\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4056\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -108801,14 +108801,14 @@ stage: Added - name: Added2058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4056\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4056\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4057\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4057\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -108816,14 +108816,14 @@ stage: Added - name: Added2060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4057\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4057\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4058\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4058\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -108831,14 +108831,14 @@ stage: Added - name: Added2062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4058\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4058\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2063 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4059\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4059\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -108846,14 +108846,14 @@ stage: Added - name: Added2064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4059\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4059\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4060\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4060\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -108861,14 +108861,14 @@ stage: Added - name: Added2066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4060\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4060\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4061\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4061\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -108876,14 +108876,14 @@ stage: Added - name: Added2068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4061\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4061\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4062\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4062\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -108891,14 +108891,14 @@ stage: Added - name: Added2070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4062\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4062\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4063\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4063\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "checksum": @@ -108906,14 +108906,14 @@ stage: Added - name: Added2072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4063\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4063\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2073 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4064\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108928,14 +108928,14 @@ stage: Added - name: Added2074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4064\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4064\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2075 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4064","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4064","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108954,7 +108954,7 @@ stage: Modified - name: Added2076 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4065\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108969,14 +108969,14 @@ stage: Added - name: Added2077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4065\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4065\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2078 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4065","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4065","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -108995,7 +108995,7 @@ stage: Modified - name: Added2079 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4066\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109010,14 +109010,14 @@ stage: Added - name: Added2080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4066\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4066\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2081 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4066","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4066","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109036,7 +109036,7 @@ stage: Modified - name: Added2082 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4067\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109051,14 +109051,14 @@ stage: Added - name: Added2083 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4067\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4067\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2084 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4067","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4067","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109077,7 +109077,7 @@ stage: Modified - name: Added2085 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4068\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109092,14 +109092,14 @@ stage: Added - name: Added2086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4068\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4068\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2087 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4068","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4068","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109118,7 +109118,7 @@ stage: Modified - name: Added2088 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4069\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109133,14 +109133,14 @@ stage: Added - name: Added2089 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4069\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4069\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2090 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4069","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4069","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109159,7 +109159,7 @@ stage: Modified - name: Added2091 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4070\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109174,14 +109174,14 @@ stage: Added - name: Added2092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4070\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4070\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2093 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4070","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4070","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109200,7 +109200,7 @@ stage: Modified - name: Added2094 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4071\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109215,14 +109215,14 @@ stage: Added - name: Added2095 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4071\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4071\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2096 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4071","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4071","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109241,7 +109241,7 @@ stage: Modified - name: Added2097 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4072\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109256,14 +109256,14 @@ stage: Added - name: Added2098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4072\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4072\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2099 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4073\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109278,14 +109278,14 @@ stage: Added - name: Added2100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4073\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4073\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2101 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4074\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109300,14 +109300,14 @@ stage: Added - name: Added2102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4074\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4074\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2103 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4075\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109322,14 +109322,14 @@ stage: Added - name: Added2104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4075\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4075\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2105 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4076\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109344,14 +109344,14 @@ stage: Added - name: Added2106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4076\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4076\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2107 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4077\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109366,14 +109366,14 @@ stage: Added - name: Added2108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4077\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4077\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2109 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4078\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109388,14 +109388,14 @@ stage: Added - name: Added2110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4078\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4078\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2111 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4079\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109410,294 +109410,294 @@ stage: Added - name: Added2112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4079\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4079\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Added - name: Added2114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Modified - name: Added2116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Added - name: Added2117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Modified - name: Added2119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Added - name: Added2120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Modified - name: Added2122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Added - name: Added2123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Modified - name: Added2125 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Added - name: Added2126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Modified - name: Added2128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Added - name: Added2129 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Modified - name: Added2131 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Added - name: Added2132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Modified - name: Added2134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Added - name: Added2135 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606722889,"checksum":"996646a76fa763393b5e15230054e8f46e010ec5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "mtime": 1606723067, "checksum": "4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}' stage: Modified - name: Added2137 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4088\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4088\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4088\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4088\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4089\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4089\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4089\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4089\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2141 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4090\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4090\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4090\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4090\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2143 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4091\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4091\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4091\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","value_type":"REG_SZ","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4091\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4092\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4092\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4092\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4092\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Added2151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key", "arch": "[x64]", "timestamp": 1606769891, "attributes": {"type": "registry_key", "checksum": "16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}' stage: Added - name: Added2152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"added","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606769891, "attributes": {"type": "registry_value", "checksum": "88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}' stage: Added - name: Modified2153 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109720,7 +109720,7 @@ stage: Modified - name: Modified2154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": @@ -109730,7 +109730,7 @@ stage: Modified - name: Modified2155 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109753,7 +109753,7 @@ stage: Modified - name: Modified2156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": @@ -109763,7 +109763,7 @@ stage: Modified - name: Modified2157 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109786,7 +109786,7 @@ stage: Modified - name: Modified2158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -109795,7 +109795,7 @@ stage: Modified - name: Modified2159 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109818,7 +109818,7 @@ stage: Modified - name: Modified2160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -109827,7 +109827,7 @@ stage: Modified - name: Modified2161 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109850,7 +109850,7 @@ stage: Modified - name: Modified2162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": @@ -109860,7 +109860,7 @@ stage: Modified - name: Modified2163 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109883,7 +109883,7 @@ stage: Modified - name: Modified2164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": @@ -109893,7 +109893,7 @@ stage: Modified - name: Modified2165 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109916,7 +109916,7 @@ stage: Modified - name: Modified2166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -109925,7 +109925,7 @@ stage: Modified - name: Modified2167 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109948,7 +109948,7 @@ stage: Modified - name: Modified2168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -109957,7 +109957,7 @@ stage: Modified - name: Modified2169 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -109980,7 +109980,7 @@ stage: Modified - name: Modified2170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": @@ -109990,7 +109990,7 @@ stage: Modified - name: Modified2171 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110013,7 +110013,7 @@ stage: Modified - name: Modified2172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": @@ -110023,7 +110023,7 @@ stage: Modified - name: Modified2173 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110046,7 +110046,7 @@ stage: Modified - name: Modified2174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110055,7 +110055,7 @@ stage: Modified - name: Modified2175 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110078,7 +110078,7 @@ stage: Modified - name: Modified2176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110087,7 +110087,7 @@ stage: Modified - name: Modified2177 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110110,7 +110110,7 @@ stage: Modified - name: Modified2178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": @@ -110120,7 +110120,7 @@ stage: Modified - name: Modified2179 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110143,7 +110143,7 @@ stage: Modified - name: Modified2180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": @@ -110153,7 +110153,7 @@ stage: Modified - name: Modified2181 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110176,7 +110176,7 @@ stage: Modified - name: Modified2182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110185,7 +110185,7 @@ stage: Modified - name: Modified2183 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110208,7 +110208,7 @@ stage: Modified - name: Modified2184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110217,7 +110217,7 @@ stage: Modified - name: Modified2185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key", "arch": "[x64]", "timestamp": 1606816861, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110226,7 +110226,7 @@ stage: Modified - name: Modified2186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": @@ -110236,7 +110236,7 @@ stage: Modified - name: Modified2187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key", "arch": "[x64]", "timestamp": 1606816861, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110245,7 +110245,7 @@ stage: Modified - name: Modified2188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": @@ -110255,7 +110255,7 @@ stage: Modified - name: Modified2189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key", "arch": "[x64]", "timestamp": 1606816861, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110264,7 +110264,7 @@ stage: Modified - name: Modified2190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110273,7 +110273,7 @@ stage: Modified - name: Modified2191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key", "arch": "[x64]", "timestamp": 1606816861, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110282,7 +110282,7 @@ stage: Modified - name: Modified2192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110291,7 +110291,7 @@ stage: Modified - name: Modified2193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key", "arch": "[x64]", "timestamp": 1606816861, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110300,7 +110300,7 @@ stage: Modified - name: Modified2194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816861, "attributes": @@ -110310,7 +110310,7 @@ stage: Modified - name: Modified2195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110319,7 +110319,7 @@ stage: Modified - name: Modified2196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110329,7 +110329,7 @@ stage: Modified - name: Modified2197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110338,7 +110338,7 @@ stage: Modified - name: Modified2198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110347,7 +110347,7 @@ stage: Modified - name: Modified2199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110356,7 +110356,7 @@ stage: Modified - name: Modified2200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110365,7 +110365,7 @@ stage: Modified - name: Modified2201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110374,7 +110374,7 @@ stage: Modified - name: Modified2202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110384,7 +110384,7 @@ stage: Modified - name: Modified2203 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110393,7 +110393,7 @@ stage: Modified - name: Modified2204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110403,7 +110403,7 @@ stage: Modified - name: Modified2205 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110412,7 +110412,7 @@ stage: Modified - name: Modified2206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110421,7 +110421,7 @@ stage: Modified - name: Modified2207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110430,7 +110430,7 @@ stage: Modified - name: Modified2208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110439,7 +110439,7 @@ stage: Modified - name: Modified2209 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110448,7 +110448,7 @@ stage: Modified - name: Modified2210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110458,7 +110458,7 @@ stage: Modified - name: Modified2211 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110467,7 +110467,7 @@ stage: Modified - name: Modified2212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110477,7 +110477,7 @@ stage: Modified - name: Modified2213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110486,7 +110486,7 @@ stage: Modified - name: Modified2214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110495,7 +110495,7 @@ stage: Modified - name: Modified2215 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -110504,7 +110504,7 @@ stage: Modified - name: Modified2216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110513,7 +110513,7 @@ stage: Modified - name: Modified2217 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110535,7 +110535,7 @@ stage: Modified - name: Modified2218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110545,7 +110545,7 @@ stage: Modified - name: Modified2219 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110567,7 +110567,7 @@ stage: Modified - name: Modified2220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110577,7 +110577,7 @@ stage: Modified - name: Modified2221 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110599,7 +110599,7 @@ stage: Modified - name: Modified2222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110608,7 +110608,7 @@ stage: Modified - name: Modified2223 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110630,7 +110630,7 @@ stage: Modified - name: Modified2224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110639,7 +110639,7 @@ stage: Modified - name: Modified2225 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110661,7 +110661,7 @@ stage: Modified - name: Modified2226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110671,7 +110671,7 @@ stage: Modified - name: Modified2227 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110693,7 +110693,7 @@ stage: Modified - name: Modified2228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110703,7 +110703,7 @@ stage: Modified - name: Modified2229 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110725,7 +110725,7 @@ stage: Modified - name: Modified2230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110734,7 +110734,7 @@ stage: Modified - name: Modified2231 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110756,7 +110756,7 @@ stage: Modified - name: Modified2232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110765,7 +110765,7 @@ stage: Modified - name: Modified2233 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110787,7 +110787,7 @@ stage: Modified - name: Modified2234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110797,7 +110797,7 @@ stage: Modified - name: Modified2235 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110819,7 +110819,7 @@ stage: Modified - name: Modified2236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110829,7 +110829,7 @@ stage: Modified - name: Modified2237 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110851,7 +110851,7 @@ stage: Modified - name: Modified2238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110860,7 +110860,7 @@ stage: Modified - name: Modified2239 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110882,7 +110882,7 @@ stage: Modified - name: Modified2240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110891,7 +110891,7 @@ stage: Modified - name: Modified2241 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110913,7 +110913,7 @@ stage: Modified - name: Modified2242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110923,7 +110923,7 @@ stage: Modified - name: Modified2243 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110945,7 +110945,7 @@ stage: Modified - name: Modified2244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -110955,7 +110955,7 @@ stage: Modified - name: Modified2245 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -110977,7 +110977,7 @@ stage: Modified - name: Modified2246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -110986,7 +110986,7 @@ stage: Modified - name: Modified2247 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111008,7 +111008,7 @@ stage: Modified - name: Modified2248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111017,7 +111017,7 @@ stage: Modified - name: Modified2249 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111025,7 +111025,7 @@ stage: Modified - name: Modified2250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -111035,7 +111035,7 @@ stage: Modified - name: Modified2251 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111043,7 +111043,7 @@ stage: Modified - name: Modified2252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -111053,7 +111053,7 @@ stage: Modified - name: Modified2253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111061,7 +111061,7 @@ stage: Modified - name: Modified2254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111070,7 +111070,7 @@ stage: Modified - name: Modified2255 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111078,7 +111078,7 @@ stage: Modified - name: Modified2256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111087,7 +111087,7 @@ stage: Modified - name: Modified2257 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111095,7 +111095,7 @@ stage: Modified - name: Modified2258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -111105,7 +111105,7 @@ stage: Modified - name: Modified2259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111113,7 +111113,7 @@ stage: Modified - name: Modified2260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -111123,7 +111123,7 @@ stage: Modified - name: Modified2261 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111131,7 +111131,7 @@ stage: Modified - name: Modified2262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111140,7 +111140,7 @@ stage: Modified - name: Modified2263 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111148,7 +111148,7 @@ stage: Modified - name: Modified2264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111157,7 +111157,7 @@ stage: Modified - name: Modified2265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111165,7 +111165,7 @@ stage: Modified - name: Modified2266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -111175,7 +111175,7 @@ stage: Modified - name: Modified2267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key", "arch": "[x64]", "timestamp": 1606816862, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111183,7 +111183,7 @@ stage: Modified - name: Modified2268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816862, "attributes": @@ -111193,7 +111193,7 @@ stage: Modified - name: Modified2269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111201,7 +111201,7 @@ stage: Modified - name: Modified2270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111210,7 +111210,7 @@ stage: Modified - name: Modified2271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111218,7 +111218,7 @@ stage: Modified - name: Modified2272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111227,7 +111227,7 @@ stage: Modified - name: Modified2273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111235,7 +111235,7 @@ stage: Modified - name: Modified2274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111245,7 +111245,7 @@ stage: Modified - name: Modified2275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111253,7 +111253,7 @@ stage: Modified - name: Modified2276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111263,7 +111263,7 @@ stage: Modified - name: Modified2277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111271,7 +111271,7 @@ stage: Modified - name: Modified2278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111280,7 +111280,7 @@ stage: Modified - name: Modified2279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -111288,7 +111288,7 @@ stage: Modified - name: Modified2280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111297,7 +111297,7 @@ stage: Modified - name: Modified2281 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111319,7 +111319,7 @@ stage: Modified - name: Modified2282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111329,7 +111329,7 @@ stage: Modified - name: Modified2283 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111351,7 +111351,7 @@ stage: Modified - name: Modified2284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111361,7 +111361,7 @@ stage: Modified - name: Modified2285 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111383,7 +111383,7 @@ stage: Modified - name: Modified2286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111392,7 +111392,7 @@ stage: Modified - name: Modified2287 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111414,7 +111414,7 @@ stage: Modified - name: Modified2288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111423,7 +111423,7 @@ stage: Modified - name: Modified2289 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111445,7 +111445,7 @@ stage: Modified - name: Modified2290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111455,7 +111455,7 @@ stage: Modified - name: Modified2291 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111477,7 +111477,7 @@ stage: Modified - name: Modified2292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111487,7 +111487,7 @@ stage: Modified - name: Modified2293 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111509,7 +111509,7 @@ stage: Modified - name: Modified2294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111518,7 +111518,7 @@ stage: Modified - name: Modified2295 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111540,7 +111540,7 @@ stage: Modified - name: Modified2296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111549,7 +111549,7 @@ stage: Modified - name: Modified2297 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111571,7 +111571,7 @@ stage: Modified - name: Modified2298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111581,7 +111581,7 @@ stage: Modified - name: Modified2299 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111603,7 +111603,7 @@ stage: Modified - name: Modified2300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111613,7 +111613,7 @@ stage: Modified - name: Modified2301 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111635,7 +111635,7 @@ stage: Modified - name: Modified2302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111644,7 +111644,7 @@ stage: Modified - name: Modified2303 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111666,7 +111666,7 @@ stage: Modified - name: Modified2304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111675,7 +111675,7 @@ stage: Modified - name: Modified2305 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111697,7 +111697,7 @@ stage: Modified - name: Modified2306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111707,7 +111707,7 @@ stage: Modified - name: Modified2307 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111729,7 +111729,7 @@ stage: Modified - name: Modified2308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111739,7 +111739,7 @@ stage: Modified - name: Modified2309 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111761,7 +111761,7 @@ stage: Modified - name: Modified2310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111770,7 +111770,7 @@ stage: Modified - name: Modified2311 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -111792,7 +111792,7 @@ stage: Modified - name: Modified2312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111801,7 +111801,7 @@ stage: Modified - name: Modified2313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -111809,7 +111809,7 @@ stage: Modified - name: Modified2314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111819,7 +111819,7 @@ stage: Modified - name: Modified2315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -111827,7 +111827,7 @@ stage: Modified - name: Modified2316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111837,7 +111837,7 @@ stage: Modified - name: Modified2317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -111845,7 +111845,7 @@ stage: Modified - name: Modified2318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111854,7 +111854,7 @@ stage: Modified - name: Modified2319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -111862,7 +111862,7 @@ stage: Modified - name: Modified2320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111871,7 +111871,7 @@ stage: Modified - name: Modified2321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -111879,7 +111879,7 @@ stage: Modified - name: Modified2322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111889,7 +111889,7 @@ stage: Modified - name: Modified2323 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -111897,7 +111897,7 @@ stage: Modified - name: Modified2324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111907,7 +111907,7 @@ stage: Modified - name: Modified2325 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -111915,7 +111915,7 @@ stage: Modified - name: Modified2326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111924,7 +111924,7 @@ stage: Modified - name: Modified2327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key", "arch": "[x64]", "timestamp": 1606816863, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -111932,7 +111932,7 @@ stage: Modified - name: Modified2328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111941,7 +111941,7 @@ stage: Modified - name: Modified2329 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111951,7 +111951,7 @@ stage: Modified - name: Modified2330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111961,7 +111961,7 @@ stage: Modified - name: Modified2331 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111970,7 +111970,7 @@ stage: Modified - name: Modified2332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -111979,7 +111979,7 @@ stage: Modified - name: Modified2333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111989,7 +111989,7 @@ stage: Modified - name: Modified2334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816863, "attributes": @@ -111999,7 +111999,7 @@ stage: Modified - name: Modified2335 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112008,7 +112008,7 @@ stage: Modified - name: Modified2336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112017,7 +112017,7 @@ stage: Modified - name: Modified2337 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112038,7 +112038,7 @@ stage: Modified - name: Modified2338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112048,7 +112048,7 @@ stage: Modified - name: Modified2339 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112069,7 +112069,7 @@ stage: Modified - name: Modified2340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112079,7 +112079,7 @@ stage: Modified - name: Modified2341 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112100,7 +112100,7 @@ stage: Modified - name: Modified2342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112109,7 +112109,7 @@ stage: Modified - name: Modified2343 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112130,7 +112130,7 @@ stage: Modified - name: Modified2344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112139,7 +112139,7 @@ stage: Modified - name: Modified2345 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112160,7 +112160,7 @@ stage: Modified - name: Modified2346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112170,7 +112170,7 @@ stage: Modified - name: Modified2347 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112191,7 +112191,7 @@ stage: Modified - name: Modified2348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112201,7 +112201,7 @@ stage: Modified - name: Modified2349 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112222,7 +112222,7 @@ stage: Modified - name: Modified2350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112231,7 +112231,7 @@ stage: Modified - name: Modified2351 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112252,7 +112252,7 @@ stage: Modified - name: Modified2352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112261,7 +112261,7 @@ stage: Modified - name: Modified2353 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112282,7 +112282,7 @@ stage: Modified - name: Modified2354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112292,7 +112292,7 @@ stage: Modified - name: Modified2355 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112313,7 +112313,7 @@ stage: Modified - name: Modified2356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112323,7 +112323,7 @@ stage: Modified - name: Modified2357 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112344,7 +112344,7 @@ stage: Modified - name: Modified2358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112353,7 +112353,7 @@ stage: Modified - name: Modified2359 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112374,7 +112374,7 @@ stage: Modified - name: Modified2360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112383,7 +112383,7 @@ stage: Modified - name: Modified2361 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112404,7 +112404,7 @@ stage: Modified - name: Modified2362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112414,7 +112414,7 @@ stage: Modified - name: Modified2363 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112435,7 +112435,7 @@ stage: Modified - name: Modified2364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112445,7 +112445,7 @@ stage: Modified - name: Modified2365 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112466,7 +112466,7 @@ stage: Modified - name: Modified2366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112475,7 +112475,7 @@ stage: Modified - name: Modified2367 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112496,7 +112496,7 @@ stage: Modified - name: Modified2368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112505,14 +112505,14 @@ stage: Modified - name: Modified2369 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key", "arch": "[x64]", "timestamp": 1606816864, "attributes": {"type": "registry_key", "mtime": 1606769988, "checksum": "f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}' stage: Modified - name: Modified2370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112522,14 +112522,14 @@ stage: Modified - name: Modified2371 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key", "arch": "[x64]", "timestamp": 1606816864, "attributes": {"type": "registry_key", "mtime": 1606769988, "checksum": "f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}' stage: Modified - name: Modified2372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112539,14 +112539,14 @@ stage: Modified - name: Modified2373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key", "arch": "[x64]", "timestamp": 1606816864, "attributes": {"type": "registry_key", "mtime": 1606769988, "checksum": "f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}' stage: Modified - name: Modified2374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112555,14 +112555,14 @@ stage: Modified - name: Modified2375 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key", "arch": "[x64]", "timestamp": 1606816864, "attributes": {"type": "registry_key", "mtime": 1606769988, "checksum": "f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}' stage: Modified - name: Modified2376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112571,14 +112571,14 @@ stage: Modified - name: Modified2377 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key", "arch": "[x64]", "timestamp": 1606816864, "attributes": {"type": "registry_key", "mtime": 1606769988, "checksum": "f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}' stage: Modified - name: Modified2378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112588,14 +112588,14 @@ stage: Modified - name: Modified2379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key", "arch": "[x64]", "timestamp": 1606816864, "attributes": {"type": "registry_key", "mtime": 1606769988, "checksum": "f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}' stage: Modified - name: Modified2380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112605,14 +112605,14 @@ stage: Modified - name: Modified2381 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key", "arch": "[x64]", "timestamp": 1606816864, "attributes": {"type": "registry_key", "mtime": 1606769988, "checksum": "f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}' stage: Modified - name: Modified2382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112621,14 +112621,14 @@ stage: Modified - name: Modified2383 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key", "arch": "[x64]", "timestamp": 1606816864, "attributes": {"type": "registry_key", "mtime": 1606769988, "checksum": "f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}' stage: Modified - name: Modified2384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112637,7 +112637,7 @@ stage: Modified - name: Modified2385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112647,7 +112647,7 @@ stage: Modified - name: Modified2386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112657,7 +112657,7 @@ stage: Modified - name: Modified2387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112666,7 +112666,7 @@ stage: Modified - name: Modified2388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112675,7 +112675,7 @@ stage: Modified - name: Modified2389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112685,7 +112685,7 @@ stage: Modified - name: Modified2390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112695,7 +112695,7 @@ stage: Modified - name: Modified2391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112704,7 +112704,7 @@ stage: Modified - name: Modified2392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112713,7 +112713,7 @@ stage: Modified - name: Modified2393 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112736,7 +112736,7 @@ stage: Modified - name: Modified2394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112746,7 +112746,7 @@ stage: Modified - name: Modified2395 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112769,7 +112769,7 @@ stage: Modified - name: Modified2396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816864, "attributes": @@ -112779,7 +112779,7 @@ stage: Modified - name: Modified2397 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112802,7 +112802,7 @@ stage: Modified - name: Modified2398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112811,7 +112811,7 @@ stage: Modified - name: Modified2399 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112834,7 +112834,7 @@ stage: Modified - name: Modified2400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -112843,7 +112843,7 @@ stage: Modified - name: Modified2401 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112866,7 +112866,7 @@ stage: Modified - name: Modified2402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -112876,7 +112876,7 @@ stage: Modified - name: Modified2403 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112899,7 +112899,7 @@ stage: Modified - name: Modified2404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -112909,7 +112909,7 @@ stage: Modified - name: Modified2405 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112932,7 +112932,7 @@ stage: Modified - name: Modified2406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -112941,7 +112941,7 @@ stage: Modified - name: Modified2407 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112964,7 +112964,7 @@ stage: Modified - name: Modified2408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -112973,7 +112973,7 @@ stage: Modified - name: Modified2409 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -112996,7 +112996,7 @@ stage: Modified - name: Modified2410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113006,7 +113006,7 @@ stage: Modified - name: Modified2411 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113029,7 +113029,7 @@ stage: Modified - name: Modified2412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113039,7 +113039,7 @@ stage: Modified - name: Modified2413 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113062,7 +113062,7 @@ stage: Modified - name: Modified2414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -113071,7 +113071,7 @@ stage: Modified - name: Modified2415 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113094,7 +113094,7 @@ stage: Modified - name: Modified2416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -113103,7 +113103,7 @@ stage: Modified - name: Modified2417 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113126,7 +113126,7 @@ stage: Modified - name: Modified2418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113136,7 +113136,7 @@ stage: Modified - name: Modified2419 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113159,7 +113159,7 @@ stage: Modified - name: Modified2420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113169,7 +113169,7 @@ stage: Modified - name: Modified2421 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113192,7 +113192,7 @@ stage: Modified - name: Modified2422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -113201,7 +113201,7 @@ stage: Modified - name: Modified2423 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113224,7 +113224,7 @@ stage: Modified - name: Modified2424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -113233,7 +113233,7 @@ stage: Modified - name: Modified2425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113242,7 +113242,7 @@ stage: Modified - name: Modified2426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113252,7 +113252,7 @@ stage: Modified - name: Modified2427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113261,7 +113261,7 @@ stage: Modified - name: Modified2428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113271,7 +113271,7 @@ stage: Modified - name: Modified2429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113280,7 +113280,7 @@ stage: Modified - name: Modified2430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -113289,7 +113289,7 @@ stage: Modified - name: Modified2431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113298,7 +113298,7 @@ stage: Modified - name: Modified2432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -113307,7 +113307,7 @@ stage: Modified - name: Modified2433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113316,7 +113316,7 @@ stage: Modified - name: Modified2434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113326,7 +113326,7 @@ stage: Modified - name: Modified2435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113335,7 +113335,7 @@ stage: Modified - name: Modified2436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113345,7 +113345,7 @@ stage: Modified - name: Modified2437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113354,7 +113354,7 @@ stage: Modified - name: Modified2438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -113363,7 +113363,7 @@ stage: Modified - name: Modified2439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113372,7 +113372,7 @@ stage: Modified - name: Modified2440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -113381,7 +113381,7 @@ stage: Modified - name: Modified2441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113390,7 +113390,7 @@ stage: Modified - name: Modified2442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113400,7 +113400,7 @@ stage: Modified - name: Modified2443 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113409,7 +113409,7 @@ stage: Modified - name: Modified2444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113419,7 +113419,7 @@ stage: Modified - name: Modified2445 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113428,7 +113428,7 @@ stage: Modified - name: Modified2446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -113437,7 +113437,7 @@ stage: Modified - name: Modified2447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113446,7 +113446,7 @@ stage: Modified - name: Modified2448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -113455,7 +113455,7 @@ stage: Modified - name: Modified2449 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113464,7 +113464,7 @@ stage: Modified - name: Modified2450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113474,7 +113474,7 @@ stage: Modified - name: Modified2451 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113483,7 +113483,7 @@ stage: Modified - name: Modified2452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113493,7 +113493,7 @@ stage: Modified - name: Modified2453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113502,7 +113502,7 @@ stage: Modified - name: Modified2454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -113511,7 +113511,7 @@ stage: Modified - name: Modified2455 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key", "arch": "[x64]", "timestamp": 1606816865, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -113520,7 +113520,7 @@ stage: Modified - name: Modified2456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -113529,7 +113529,7 @@ stage: Modified - name: Modified2457 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113551,7 +113551,7 @@ stage: Modified - name: Modified2458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113561,7 +113561,7 @@ stage: Modified - name: Modified2459 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113583,7 +113583,7 @@ stage: Modified - name: Modified2460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113593,7 +113593,7 @@ stage: Modified - name: Modified2461 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113615,7 +113615,7 @@ stage: Modified - name: Modified2462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -113624,7 +113624,7 @@ stage: Modified - name: Modified2463 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113646,7 +113646,7 @@ stage: Modified - name: Modified2464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -113655,7 +113655,7 @@ stage: Modified - name: Modified2465 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113677,7 +113677,7 @@ stage: Modified - name: Modified2466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113687,7 +113687,7 @@ stage: Modified - name: Modified2467 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113709,7 +113709,7 @@ stage: Modified - name: Modified2468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816865, "attributes": @@ -113719,7 +113719,7 @@ stage: Modified - name: Modified2469 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113741,7 +113741,7 @@ stage: Modified - name: Modified2470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -113750,7 +113750,7 @@ stage: Modified - name: Modified2471 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113772,7 +113772,7 @@ stage: Modified - name: Modified2472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -113781,7 +113781,7 @@ stage: Modified - name: Modified2473 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113803,7 +113803,7 @@ stage: Modified - name: Modified2474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -113813,7 +113813,7 @@ stage: Modified - name: Modified2475 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113835,7 +113835,7 @@ stage: Modified - name: Modified2476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -113845,7 +113845,7 @@ stage: Modified - name: Modified2477 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113867,7 +113867,7 @@ stage: Modified - name: Modified2478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -113876,7 +113876,7 @@ stage: Modified - name: Modified2479 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113898,7 +113898,7 @@ stage: Modified - name: Modified2480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -113907,7 +113907,7 @@ stage: Modified - name: Modified2481 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113929,7 +113929,7 @@ stage: Modified - name: Modified2482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -113939,7 +113939,7 @@ stage: Modified - name: Modified2483 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113961,7 +113961,7 @@ stage: Modified - name: Modified2484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -113971,7 +113971,7 @@ stage: Modified - name: Modified2485 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -113993,7 +113993,7 @@ stage: Modified - name: Modified2486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114002,7 +114002,7 @@ stage: Modified - name: Modified2487 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114024,7 +114024,7 @@ stage: Modified - name: Modified2488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114033,7 +114033,7 @@ stage: Modified - name: Modified2489 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114041,7 +114041,7 @@ stage: Modified - name: Modified2490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114051,7 +114051,7 @@ stage: Modified - name: Modified2491 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114059,7 +114059,7 @@ stage: Modified - name: Modified2492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114069,7 +114069,7 @@ stage: Modified - name: Modified2493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114077,7 +114077,7 @@ stage: Modified - name: Modified2494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114086,7 +114086,7 @@ stage: Modified - name: Modified2495 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114094,7 +114094,7 @@ stage: Modified - name: Modified2496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114103,7 +114103,7 @@ stage: Modified - name: Modified2497 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114111,7 +114111,7 @@ stage: Modified - name: Modified2498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114121,7 +114121,7 @@ stage: Modified - name: Modified2499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114129,7 +114129,7 @@ stage: Modified - name: Modified2500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114139,7 +114139,7 @@ stage: Modified - name: Modified2501 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114147,7 +114147,7 @@ stage: Modified - name: Modified2502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114156,7 +114156,7 @@ stage: Modified - name: Modified2503 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114164,7 +114164,7 @@ stage: Modified - name: Modified2504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114173,7 +114173,7 @@ stage: Modified - name: Modified2505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114181,7 +114181,7 @@ stage: Modified - name: Modified2506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114191,7 +114191,7 @@ stage: Modified - name: Modified2507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114199,7 +114199,7 @@ stage: Modified - name: Modified2508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114209,7 +114209,7 @@ stage: Modified - name: Modified2509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114217,7 +114217,7 @@ stage: Modified - name: Modified2510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114226,7 +114226,7 @@ stage: Modified - name: Modified2511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114234,7 +114234,7 @@ stage: Modified - name: Modified2512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114243,7 +114243,7 @@ stage: Modified - name: Modified2513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114251,7 +114251,7 @@ stage: Modified - name: Modified2514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114261,7 +114261,7 @@ stage: Modified - name: Modified2515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114269,7 +114269,7 @@ stage: Modified - name: Modified2516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114279,7 +114279,7 @@ stage: Modified - name: Modified2517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114287,7 +114287,7 @@ stage: Modified - name: Modified2518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114296,7 +114296,7 @@ stage: Modified - name: Modified2519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key", "arch": "[x64]", "timestamp": 1606816866, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -114304,7 +114304,7 @@ stage: Modified - name: Modified2520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114313,7 +114313,7 @@ stage: Modified - name: Modified2521 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114335,7 +114335,7 @@ stage: Modified - name: Modified2522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114345,7 +114345,7 @@ stage: Modified - name: Modified2523 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114367,7 +114367,7 @@ stage: Modified - name: Modified2524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114377,7 +114377,7 @@ stage: Modified - name: Modified2525 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114399,7 +114399,7 @@ stage: Modified - name: Modified2526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114408,7 +114408,7 @@ stage: Modified - name: Modified2527 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114430,7 +114430,7 @@ stage: Modified - name: Modified2528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114439,7 +114439,7 @@ stage: Modified - name: Modified2529 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114461,7 +114461,7 @@ stage: Modified - name: Modified2530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114471,7 +114471,7 @@ stage: Modified - name: Modified2531 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114493,7 +114493,7 @@ stage: Modified - name: Modified2532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": @@ -114503,7 +114503,7 @@ stage: Modified - name: Modified2533 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114525,7 +114525,7 @@ stage: Modified - name: Modified2534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114534,7 +114534,7 @@ stage: Modified - name: Modified2535 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114556,7 +114556,7 @@ stage: Modified - name: Modified2536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816866, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114565,7 +114565,7 @@ stage: Modified - name: Modified2537 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114587,7 +114587,7 @@ stage: Modified - name: Modified2538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -114597,7 +114597,7 @@ stage: Modified - name: Modified2539 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114619,7 +114619,7 @@ stage: Modified - name: Modified2540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -114629,7 +114629,7 @@ stage: Modified - name: Modified2541 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114651,7 +114651,7 @@ stage: Modified - name: Modified2542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114660,7 +114660,7 @@ stage: Modified - name: Modified2543 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114682,7 +114682,7 @@ stage: Modified - name: Modified2544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114691,7 +114691,7 @@ stage: Modified - name: Modified2545 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114713,7 +114713,7 @@ stage: Modified - name: Modified2546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -114723,7 +114723,7 @@ stage: Modified - name: Modified2547 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114745,7 +114745,7 @@ stage: Modified - name: Modified2548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -114755,7 +114755,7 @@ stage: Modified - name: Modified2549 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114777,7 +114777,7 @@ stage: Modified - name: Modified2550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114786,7 +114786,7 @@ stage: Modified - name: Modified2551 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -114808,7 +114808,7 @@ stage: Modified - name: Modified2552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114817,7 +114817,7 @@ stage: Modified - name: Modified2553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key", "arch": "[x64]", "timestamp": 1606816867, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -114825,7 +114825,7 @@ stage: Modified - name: Modified2554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -114835,7 +114835,7 @@ stage: Modified - name: Modified2555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key", "arch": "[x64]", "timestamp": 1606816867, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -114843,7 +114843,7 @@ stage: Modified - name: Modified2556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -114853,7 +114853,7 @@ stage: Modified - name: Modified2557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key", "arch": "[x64]", "timestamp": 1606816867, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -114861,7 +114861,7 @@ stage: Modified - name: Modified2558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114870,7 +114870,7 @@ stage: Modified - name: Modified2559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key", "arch": "[x64]", "timestamp": 1606816867, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -114878,7 +114878,7 @@ stage: Modified - name: Modified2560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114887,7 +114887,7 @@ stage: Modified - name: Modified2561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key", "arch": "[x64]", "timestamp": 1606816867, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -114895,7 +114895,7 @@ stage: Modified - name: Modified2562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -114905,7 +114905,7 @@ stage: Modified - name: Modified2563 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key", "arch": "[x64]", "timestamp": 1606816867, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -114913,7 +114913,7 @@ stage: Modified - name: Modified2564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -114923,7 +114923,7 @@ stage: Modified - name: Modified2565 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key", "arch": "[x64]", "timestamp": 1606816867, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -114931,7 +114931,7 @@ stage: Modified - name: Modified2566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114940,7 +114940,7 @@ stage: Modified - name: Modified2567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key", "arch": "[x64]", "timestamp": 1606816867, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -114948,7 +114948,7 @@ stage: Modified - name: Modified2568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -114957,7 +114957,7 @@ stage: Modified - name: Modified2569 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -114967,7 +114967,7 @@ stage: Modified - name: Modified2570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -114977,7 +114977,7 @@ stage: Modified - name: Modified2571 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114986,7 +114986,7 @@ stage: Modified - name: Modified2572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -114995,7 +114995,7 @@ stage: Modified - name: Modified2573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -115005,7 +115005,7 @@ stage: Modified - name: Modified2574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -115015,7 +115015,7 @@ stage: Modified - name: Modified2575 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -115024,7 +115024,7 @@ stage: Modified - name: Modified2576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -115033,7 +115033,7 @@ stage: Modified - name: Modified2577 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115054,7 +115054,7 @@ stage: Modified - name: Modified2578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -115064,7 +115064,7 @@ stage: Modified - name: Modified2579 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115085,7 +115085,7 @@ stage: Modified - name: Modified2580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -115095,7 +115095,7 @@ stage: Modified - name: Modified2581 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115116,7 +115116,7 @@ stage: Modified - name: Modified2582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115125,7 +115125,7 @@ stage: Modified - name: Modified2583 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115146,7 +115146,7 @@ stage: Modified - name: Modified2584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115155,7 +115155,7 @@ stage: Modified - name: Modified2585 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115176,7 +115176,7 @@ stage: Modified - name: Modified2586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -115186,7 +115186,7 @@ stage: Modified - name: Modified2587 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115207,7 +115207,7 @@ stage: Modified - name: Modified2588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -115217,7 +115217,7 @@ stage: Modified - name: Modified2589 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115238,7 +115238,7 @@ stage: Modified - name: Modified2590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -115247,7 +115247,7 @@ stage: Modified - name: Modified2591 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115268,7 +115268,7 @@ stage: Modified - name: Modified2592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -115277,7 +115277,7 @@ stage: Modified - name: Modified2593 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115298,7 +115298,7 @@ stage: Modified - name: Modified2594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -115308,7 +115308,7 @@ stage: Modified - name: Modified2595 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115329,7 +115329,7 @@ stage: Modified - name: Modified2596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -115339,7 +115339,7 @@ stage: Modified - name: Modified2597 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115360,7 +115360,7 @@ stage: Modified - name: Modified2598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115369,7 +115369,7 @@ stage: Modified - name: Modified2599 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115390,7 +115390,7 @@ stage: Modified - name: Modified2600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115399,7 +115399,7 @@ stage: Modified - name: Modified2601 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115420,7 +115420,7 @@ stage: Modified - name: Modified2602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816867, "attributes": @@ -115430,7 +115430,7 @@ stage: Modified - name: Modified2603 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115451,7 +115451,7 @@ stage: Modified - name: Modified2604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115461,7 +115461,7 @@ stage: Modified - name: Modified2605 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115482,7 +115482,7 @@ stage: Modified - name: Modified2606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -115491,7 +115491,7 @@ stage: Modified - name: Modified2607 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115512,7 +115512,7 @@ stage: Modified - name: Modified2608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -115521,14 +115521,14 @@ stage: Modified - name: Modified2609 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key", "arch": "[x64]", "timestamp": 1606816868, "attributes": {"type": "registry_key", "mtime": 1606769990, "checksum": "64c908843f85040653cea0e66cb9bfd6176e5214"}}' stage: Modified - name: Modified2610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115538,14 +115538,14 @@ stage: Modified - name: Modified2611 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key", "arch": "[x64]", "timestamp": 1606816868, "attributes": {"type": "registry_key", "mtime": 1606769990, "checksum": "64c908843f85040653cea0e66cb9bfd6176e5214"}}' stage: Modified - name: Modified2612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115555,14 +115555,14 @@ stage: Modified - name: Modified2613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key", "arch": "[x64]", "timestamp": 1606816868, "attributes": {"type": "registry_key", "mtime": 1606769990, "checksum": "64c908843f85040653cea0e66cb9bfd6176e5214"}}' stage: Modified - name: Modified2614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115571,14 +115571,14 @@ stage: Modified - name: Modified2615 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key", "arch": "[x64]", "timestamp": 1606816868, "attributes": {"type": "registry_key", "mtime": 1606769990, "checksum": "64c908843f85040653cea0e66cb9bfd6176e5214"}}' stage: Modified - name: Modified2616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115587,14 +115587,14 @@ stage: Modified - name: Modified2617 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key", "arch": "[x64]", "timestamp": 1606816868, "attributes": {"type": "registry_key", "mtime": 1606769990, "checksum": "64c908843f85040653cea0e66cb9bfd6176e5214"}}' stage: Modified - name: Modified2618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115604,14 +115604,14 @@ stage: Modified - name: Modified2619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key", "arch": "[x64]", "timestamp": 1606816868, "attributes": {"type": "registry_key", "mtime": 1606769990, "checksum": "64c908843f85040653cea0e66cb9bfd6176e5214"}}' stage: Modified - name: Modified2620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115621,14 +115621,14 @@ stage: Modified - name: Modified2621 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key", "arch": "[x64]", "timestamp": 1606816868, "attributes": {"type": "registry_key", "mtime": 1606769990, "checksum": "64c908843f85040653cea0e66cb9bfd6176e5214"}}' stage: Modified - name: Modified2622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -115637,14 +115637,14 @@ stage: Modified - name: Modified2623 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key", "arch": "[x64]", "timestamp": 1606816868, "attributes": {"type": "registry_key", "mtime": 1606769990, "checksum": "64c908843f85040653cea0e66cb9bfd6176e5214"}}' stage: Modified - name: Modified2624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -115653,7 +115653,7 @@ stage: Modified - name: Modified2625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115663,7 +115663,7 @@ stage: Modified - name: Modified2626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115673,7 +115673,7 @@ stage: Modified - name: Modified2627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115682,7 +115682,7 @@ stage: Modified - name: Modified2628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115691,7 +115691,7 @@ stage: Modified - name: Modified2629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115701,7 +115701,7 @@ stage: Modified - name: Modified2630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115711,7 +115711,7 @@ stage: Modified - name: Modified2631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -115720,7 +115720,7 @@ stage: Modified - name: Modified2632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -115729,7 +115729,7 @@ stage: Modified - name: Modified2633 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115752,7 +115752,7 @@ stage: Modified - name: Modified2634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115761,7 +115761,7 @@ stage: Modified - name: Modified2635 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115784,7 +115784,7 @@ stage: Modified - name: Modified2636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115793,7 +115793,7 @@ stage: Modified - name: Modified2637 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115816,7 +115816,7 @@ stage: Modified - name: Modified2638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115824,7 +115824,7 @@ stage: Modified - name: Modified2639 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115847,7 +115847,7 @@ stage: Modified - name: Modified2640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115855,7 +115855,7 @@ stage: Modified - name: Modified2641 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115878,7 +115878,7 @@ stage: Modified - name: Modified2642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115887,7 +115887,7 @@ stage: Modified - name: Modified2643 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115910,7 +115910,7 @@ stage: Modified - name: Modified2644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -115919,7 +115919,7 @@ stage: Modified - name: Modified2645 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115942,7 +115942,7 @@ stage: Modified - name: Modified2646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115950,7 +115950,7 @@ stage: Modified - name: Modified2647 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -115973,7 +115973,7 @@ stage: Modified - name: Modified2648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -115981,7 +115981,7 @@ stage: Modified - name: Modified2649 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116004,7 +116004,7 @@ stage: Modified - name: Modified2650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -116013,7 +116013,7 @@ stage: Modified - name: Modified2651 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116036,7 +116036,7 @@ stage: Modified - name: Modified2652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -116045,7 +116045,7 @@ stage: Modified - name: Modified2653 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116068,7 +116068,7 @@ stage: Modified - name: Modified2654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116076,7 +116076,7 @@ stage: Modified - name: Modified2655 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116099,7 +116099,7 @@ stage: Modified - name: Modified2656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116107,7 +116107,7 @@ stage: Modified - name: Modified2657 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg268\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116130,7 +116130,7 @@ stage: Modified - name: Modified2658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg268\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg268\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -116139,7 +116139,7 @@ stage: Modified - name: Modified2659 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg269\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116162,7 +116162,7 @@ stage: Modified - name: Modified2660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg269\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg269\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -116171,7 +116171,7 @@ stage: Modified - name: Modified2661 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg270\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116194,7 +116194,7 @@ stage: Modified - name: Modified2662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg270\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg270\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116202,7 +116202,7 @@ stage: Modified - name: Modified2663 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg271\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116225,7 +116225,7 @@ stage: Modified - name: Modified2664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg271\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg271\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116233,7 +116233,7 @@ stage: Modified - name: Modified2665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key", "arch": "[x64]", "timestamp": 1606816868, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116242,7 +116242,7 @@ stage: Modified - name: Modified2666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816868, "attributes": @@ -116251,7 +116251,7 @@ stage: Modified - name: Modified2667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116260,7 +116260,7 @@ stage: Modified - name: Modified2668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116269,7 +116269,7 @@ stage: Modified - name: Modified2669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116278,7 +116278,7 @@ stage: Modified - name: Modified2670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116286,7 +116286,7 @@ stage: Modified - name: Modified2671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116295,7 +116295,7 @@ stage: Modified - name: Modified2672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116303,7 +116303,7 @@ stage: Modified - name: Modified2673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116312,7 +116312,7 @@ stage: Modified - name: Modified2674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116321,7 +116321,7 @@ stage: Modified - name: Modified2675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116330,7 +116330,7 @@ stage: Modified - name: Modified2676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116339,7 +116339,7 @@ stage: Modified - name: Modified2677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116348,7 +116348,7 @@ stage: Modified - name: Modified2678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116356,7 +116356,7 @@ stage: Modified - name: Modified2679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769990,"checksum":"520aefe6c3647f1d553c9b6dc84eee167827464c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116365,7 +116365,7 @@ stage: Modified - name: Modified2680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116373,7 +116373,7 @@ stage: Modified - name: Modified2681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116382,7 +116382,7 @@ stage: Modified - name: Modified2682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg280\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116391,7 +116391,7 @@ stage: Modified - name: Modified2683 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116400,7 +116400,7 @@ stage: Modified - name: Modified2684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg281\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116409,7 +116409,7 @@ stage: Modified - name: Modified2685 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116418,7 +116418,7 @@ stage: Modified - name: Modified2686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg282\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116426,7 +116426,7 @@ stage: Modified - name: Modified2687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116435,7 +116435,7 @@ stage: Modified - name: Modified2688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg283\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116443,7 +116443,7 @@ stage: Modified - name: Modified2689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116452,7 +116452,7 @@ stage: Modified - name: Modified2690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg284\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116461,7 +116461,7 @@ stage: Modified - name: Modified2691 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116470,7 +116470,7 @@ stage: Modified - name: Modified2692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg285\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116479,7 +116479,7 @@ stage: Modified - name: Modified2693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116488,7 +116488,7 @@ stage: Modified - name: Modified2694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg286\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116496,7 +116496,7 @@ stage: Modified - name: Modified2695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -116505,7 +116505,7 @@ stage: Modified - name: Modified2696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg287\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116513,7 +116513,7 @@ stage: Modified - name: Modified2697 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116535,7 +116535,7 @@ stage: Modified - name: Modified2698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116544,7 +116544,7 @@ stage: Modified - name: Modified2699 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116566,7 +116566,7 @@ stage: Modified - name: Modified2700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116575,7 +116575,7 @@ stage: Modified - name: Modified2701 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116597,7 +116597,7 @@ stage: Modified - name: Modified2702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116605,7 +116605,7 @@ stage: Modified - name: Modified2703 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116627,7 +116627,7 @@ stage: Modified - name: Modified2704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116635,7 +116635,7 @@ stage: Modified - name: Modified2705 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116657,7 +116657,7 @@ stage: Modified - name: Modified2706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116666,7 +116666,7 @@ stage: Modified - name: Modified2707 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116688,7 +116688,7 @@ stage: Modified - name: Modified2708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116697,7 +116697,7 @@ stage: Modified - name: Modified2709 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116719,7 +116719,7 @@ stage: Modified - name: Modified2710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116727,7 +116727,7 @@ stage: Modified - name: Modified2711 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116749,7 +116749,7 @@ stage: Modified - name: Modified2712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116757,7 +116757,7 @@ stage: Modified - name: Modified2713 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg296\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116779,7 +116779,7 @@ stage: Modified - name: Modified2714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg296\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg296\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116788,7 +116788,7 @@ stage: Modified - name: Modified2715 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg297\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116810,7 +116810,7 @@ stage: Modified - name: Modified2716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg297\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg297\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116819,7 +116819,7 @@ stage: Modified - name: Modified2717 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg298\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116841,7 +116841,7 @@ stage: Modified - name: Modified2718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg298\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg298\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116849,7 +116849,7 @@ stage: Modified - name: Modified2719 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg299\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116871,7 +116871,7 @@ stage: Modified - name: Modified2720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg299\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg299\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116879,7 +116879,7 @@ stage: Modified - name: Modified2721 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg300\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116901,7 +116901,7 @@ stage: Modified - name: Modified2722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg300\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg300\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116910,7 +116910,7 @@ stage: Modified - name: Modified2723 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg301\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116932,7 +116932,7 @@ stage: Modified - name: Modified2724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg301\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg301\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -116941,7 +116941,7 @@ stage: Modified - name: Modified2725 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg302\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116963,7 +116963,7 @@ stage: Modified - name: Modified2726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg302\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg302\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -116971,7 +116971,7 @@ stage: Modified - name: Modified2727 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg303\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -116993,7 +116993,7 @@ stage: Modified - name: Modified2728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg303\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg303\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117001,7 +117001,7 @@ stage: Modified - name: Modified2729 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117009,7 +117009,7 @@ stage: Modified - name: Modified2730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -117018,7 +117018,7 @@ stage: Modified - name: Modified2731 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117026,7 +117026,7 @@ stage: Modified - name: Modified2732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -117035,7 +117035,7 @@ stage: Modified - name: Modified2733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117043,7 +117043,7 @@ stage: Modified - name: Modified2734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117051,7 +117051,7 @@ stage: Modified - name: Modified2735 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117059,7 +117059,7 @@ stage: Modified - name: Modified2736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117067,7 +117067,7 @@ stage: Modified - name: Modified2737 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117075,7 +117075,7 @@ stage: Modified - name: Modified2738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -117084,7 +117084,7 @@ stage: Modified - name: Modified2739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117092,7 +117092,7 @@ stage: Modified - name: Modified2740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": @@ -117101,7 +117101,7 @@ stage: Modified - name: Modified2741 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816869,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key", "arch": "[x64]", "timestamp": 1606816869, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117109,7 +117109,7 @@ stage: Modified - name: Modified2742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816869,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816869, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117117,7 +117117,7 @@ stage: Modified - name: Modified2743 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769991,"checksum":"6c80d45136cd596bb2037bba726e5b08362656cc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117125,7 +117125,7 @@ stage: Modified - name: Modified2744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117133,7 +117133,7 @@ stage: Modified - name: Modified2745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117141,7 +117141,7 @@ stage: Modified - name: Modified2746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg312\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117150,7 +117150,7 @@ stage: Modified - name: Modified2747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117158,7 +117158,7 @@ stage: Modified - name: Modified2748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg313\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117167,7 +117167,7 @@ stage: Modified - name: Modified2749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117175,7 +117175,7 @@ stage: Modified - name: Modified2750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg314\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117183,7 +117183,7 @@ stage: Modified - name: Modified2751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117191,7 +117191,7 @@ stage: Modified - name: Modified2752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg315\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117199,7 +117199,7 @@ stage: Modified - name: Modified2753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117207,7 +117207,7 @@ stage: Modified - name: Modified2754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg316\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117216,7 +117216,7 @@ stage: Modified - name: Modified2755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117224,7 +117224,7 @@ stage: Modified - name: Modified2756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg317\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117233,7 +117233,7 @@ stage: Modified - name: Modified2757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117241,7 +117241,7 @@ stage: Modified - name: Modified2758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg318\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117249,7 +117249,7 @@ stage: Modified - name: Modified2759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -117257,7 +117257,7 @@ stage: Modified - name: Modified2760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg319\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117265,7 +117265,7 @@ stage: Modified - name: Modified2761 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117287,7 +117287,7 @@ stage: Modified - name: Modified2762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117296,7 +117296,7 @@ stage: Modified - name: Modified2763 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117318,7 +117318,7 @@ stage: Modified - name: Modified2764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117327,7 +117327,7 @@ stage: Modified - name: Modified2765 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117349,7 +117349,7 @@ stage: Modified - name: Modified2766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117357,7 +117357,7 @@ stage: Modified - name: Modified2767 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117379,7 +117379,7 @@ stage: Modified - name: Modified2768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117387,7 +117387,7 @@ stage: Modified - name: Modified2769 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117409,7 +117409,7 @@ stage: Modified - name: Modified2770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117418,7 +117418,7 @@ stage: Modified - name: Modified2771 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117440,7 +117440,7 @@ stage: Modified - name: Modified2772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117449,7 +117449,7 @@ stage: Modified - name: Modified2773 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117471,7 +117471,7 @@ stage: Modified - name: Modified2774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117479,7 +117479,7 @@ stage: Modified - name: Modified2775 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117501,7 +117501,7 @@ stage: Modified - name: Modified2776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117509,7 +117509,7 @@ stage: Modified - name: Modified2777 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg328\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117531,7 +117531,7 @@ stage: Modified - name: Modified2778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg328\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg328\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117540,7 +117540,7 @@ stage: Modified - name: Modified2779 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg329\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117562,7 +117562,7 @@ stage: Modified - name: Modified2780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg329\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg329\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117571,7 +117571,7 @@ stage: Modified - name: Modified2781 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg330\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117593,7 +117593,7 @@ stage: Modified - name: Modified2782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg330\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg330\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117601,7 +117601,7 @@ stage: Modified - name: Modified2783 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg331\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117623,7 +117623,7 @@ stage: Modified - name: Modified2784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg331\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg331\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117631,7 +117631,7 @@ stage: Modified - name: Modified2785 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg332\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117653,7 +117653,7 @@ stage: Modified - name: Modified2786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg332\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg332\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117662,7 +117662,7 @@ stage: Modified - name: Modified2787 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg333\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117684,7 +117684,7 @@ stage: Modified - name: Modified2788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg333\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg333\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117693,7 +117693,7 @@ stage: Modified - name: Modified2789 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg334\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117715,7 +117715,7 @@ stage: Modified - name: Modified2790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg334\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg334\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117723,7 +117723,7 @@ stage: Modified - name: Modified2791 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg335\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117745,7 +117745,7 @@ stage: Modified - name: Modified2792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg335\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg335\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117753,7 +117753,7 @@ stage: Modified - name: Modified2793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -117761,7 +117761,7 @@ stage: Modified - name: Modified2794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117770,7 +117770,7 @@ stage: Modified - name: Modified2795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -117778,7 +117778,7 @@ stage: Modified - name: Modified2796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117787,7 +117787,7 @@ stage: Modified - name: Modified2797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -117795,7 +117795,7 @@ stage: Modified - name: Modified2798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117803,7 +117803,7 @@ stage: Modified - name: Modified2799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -117811,7 +117811,7 @@ stage: Modified - name: Modified2800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117819,7 +117819,7 @@ stage: Modified - name: Modified2801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -117827,7 +117827,7 @@ stage: Modified - name: Modified2802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117836,7 +117836,7 @@ stage: Modified - name: Modified2803 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -117844,7 +117844,7 @@ stage: Modified - name: Modified2804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117853,7 +117853,7 @@ stage: Modified - name: Modified2805 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -117861,7 +117861,7 @@ stage: Modified - name: Modified2806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117869,7 +117869,7 @@ stage: Modified - name: Modified2807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816870,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769991,"checksum":"e26b69d7a132467ac3676eb5040fa8935a1da6b4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key", "arch": "[x64]", "timestamp": 1606816870, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -117877,7 +117877,7 @@ stage: Modified - name: Modified2808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117885,7 +117885,7 @@ stage: Modified - name: Modified2809 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg344\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg344\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117894,7 +117894,7 @@ stage: Modified - name: Modified2810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg345\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg345\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117903,7 +117903,7 @@ stage: Modified - name: Modified2811 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg346\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg346\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117911,7 +117911,7 @@ stage: Modified - name: Modified2812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg347\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg347\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117919,7 +117919,7 @@ stage: Modified - name: Modified2813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg348\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg348\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117928,7 +117928,7 @@ stage: Modified - name: Modified2814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg349\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816870,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg349\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816870, "attributes": @@ -117937,7 +117937,7 @@ stage: Modified - name: Modified2815 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg350\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg350\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117945,7 +117945,7 @@ stage: Modified - name: Modified2816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg351\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg351\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -117953,7 +117953,7 @@ stage: Modified - name: Modified2817 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -117974,7 +117974,7 @@ stage: Modified - name: Modified2818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -117983,7 +117983,7 @@ stage: Modified - name: Modified2819 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118004,7 +118004,7 @@ stage: Modified - name: Modified2820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118013,7 +118013,7 @@ stage: Modified - name: Modified2821 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118034,7 +118034,7 @@ stage: Modified - name: Modified2822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118042,7 +118042,7 @@ stage: Modified - name: Modified2823 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118063,7 +118063,7 @@ stage: Modified - name: Modified2824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118071,7 +118071,7 @@ stage: Modified - name: Modified2825 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118092,7 +118092,7 @@ stage: Modified - name: Modified2826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118101,7 +118101,7 @@ stage: Modified - name: Modified2827 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118122,7 +118122,7 @@ stage: Modified - name: Modified2828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118131,7 +118131,7 @@ stage: Modified - name: Modified2829 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118152,7 +118152,7 @@ stage: Modified - name: Modified2830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118160,7 +118160,7 @@ stage: Modified - name: Modified2831 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118181,7 +118181,7 @@ stage: Modified - name: Modified2832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118189,7 +118189,7 @@ stage: Modified - name: Modified2833 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg360\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118210,7 +118210,7 @@ stage: Modified - name: Modified2834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg360\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg360\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118219,7 +118219,7 @@ stage: Modified - name: Modified2835 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg361\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118240,7 +118240,7 @@ stage: Modified - name: Modified2836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg361\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg361\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118249,7 +118249,7 @@ stage: Modified - name: Modified2837 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg362\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118270,7 +118270,7 @@ stage: Modified - name: Modified2838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg362\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg362\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118278,7 +118278,7 @@ stage: Modified - name: Modified2839 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg363\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118299,7 +118299,7 @@ stage: Modified - name: Modified2840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg363\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg363\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118307,7 +118307,7 @@ stage: Modified - name: Modified2841 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg364\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118328,7 +118328,7 @@ stage: Modified - name: Modified2842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg364\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg364\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118337,7 +118337,7 @@ stage: Modified - name: Modified2843 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg365\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118358,7 +118358,7 @@ stage: Modified - name: Modified2844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg365\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg365\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118367,7 +118367,7 @@ stage: Modified - name: Modified2845 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg366\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118388,7 +118388,7 @@ stage: Modified - name: Modified2846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg366\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg366\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118396,7 +118396,7 @@ stage: Modified - name: Modified2847 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg367\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118417,7 +118417,7 @@ stage: Modified - name: Modified2848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg367\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg367\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118425,14 +118425,14 @@ stage: Modified - name: Modified2849 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key", "arch": "[x64]", "timestamp": 1606816871, "attributes": {"type": "registry_key", "mtime": 1606769992, "checksum": "efddcd635bae8149a41738a288aeccb4c66df1a7"}}' stage: Modified - name: Modified2850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118441,14 +118441,14 @@ stage: Modified - name: Modified2851 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key", "arch": "[x64]", "timestamp": 1606816871, "attributes": {"type": "registry_key", "mtime": 1606769992, "checksum": "efddcd635bae8149a41738a288aeccb4c66df1a7"}}' stage: Modified - name: Modified2852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118457,14 +118457,14 @@ stage: Modified - name: Modified2853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key", "arch": "[x64]", "timestamp": 1606816871, "attributes": {"type": "registry_key", "mtime": 1606769992, "checksum": "efddcd635bae8149a41738a288aeccb4c66df1a7"}}' stage: Modified - name: Modified2854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118472,14 +118472,14 @@ stage: Modified - name: Modified2855 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key", "arch": "[x64]", "timestamp": 1606816871, "attributes": {"type": "registry_key", "mtime": 1606769992, "checksum": "efddcd635bae8149a41738a288aeccb4c66df1a7"}}' stage: Modified - name: Modified2856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118487,14 +118487,14 @@ stage: Modified - name: Modified2857 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key", "arch": "[x64]", "timestamp": 1606816871, "attributes": {"type": "registry_key", "mtime": 1606769992, "checksum": "efddcd635bae8149a41738a288aeccb4c66df1a7"}}' stage: Modified - name: Modified2858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118503,14 +118503,14 @@ stage: Modified - name: Modified2859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key", "arch": "[x64]", "timestamp": 1606816871, "attributes": {"type": "registry_key", "mtime": 1606769992, "checksum": "efddcd635bae8149a41738a288aeccb4c66df1a7"}}' stage: Modified - name: Modified2860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118519,14 +118519,14 @@ stage: Modified - name: Modified2861 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key", "arch": "[x64]", "timestamp": 1606816871, "attributes": {"type": "registry_key", "mtime": 1606769992, "checksum": "efddcd635bae8149a41738a288aeccb4c66df1a7"}}' stage: Modified - name: Modified2862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118534,14 +118534,14 @@ stage: Modified - name: Modified2863 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","mtime":1606769992,"checksum":"efddcd635bae8149a41738a288aeccb4c66df1a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key", "arch": "[x64]", "timestamp": 1606816871, "attributes": {"type": "registry_key", "mtime": 1606769992, "checksum": "efddcd635bae8149a41738a288aeccb4c66df1a7"}}' stage: Modified - name: Modified2864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118549,7 +118549,7 @@ stage: Modified - name: Modified2865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg376\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg376\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118558,7 +118558,7 @@ stage: Modified - name: Modified2866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg377\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg377\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118567,7 +118567,7 @@ stage: Modified - name: Modified2867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg378\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg378\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118575,7 +118575,7 @@ stage: Modified - name: Modified2868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg379\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg379\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118583,7 +118583,7 @@ stage: Modified - name: Modified2869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg380\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg380\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118592,7 +118592,7 @@ stage: Modified - name: Modified2870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg381\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg381\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118601,7 +118601,7 @@ stage: Modified - name: Modified2871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg382\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg382\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118609,7 +118609,7 @@ stage: Modified - name: Modified2872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg383\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg383\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118617,7 +118617,7 @@ stage: Modified - name: Modified2873 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118640,7 +118640,7 @@ stage: Modified - name: Modified2874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118649,7 +118649,7 @@ stage: Modified - name: Modified2875 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118672,7 +118672,7 @@ stage: Modified - name: Modified2876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118681,7 +118681,7 @@ stage: Modified - name: Modified2877 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118704,7 +118704,7 @@ stage: Modified - name: Modified2878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118712,7 +118712,7 @@ stage: Modified - name: Modified2879 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118735,7 +118735,7 @@ stage: Modified - name: Modified2880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118743,7 +118743,7 @@ stage: Modified - name: Modified2881 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816871,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118766,7 +118766,7 @@ stage: Modified - name: Modified2882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816871,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816871, "attributes": @@ -118775,7 +118775,7 @@ stage: Modified - name: Modified2883 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118798,7 +118798,7 @@ stage: Modified - name: Modified2884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -118807,7 +118807,7 @@ stage: Modified - name: Modified2885 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118830,7 +118830,7 @@ stage: Modified - name: Modified2886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -118838,7 +118838,7 @@ stage: Modified - name: Modified2887 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118861,7 +118861,7 @@ stage: Modified - name: Modified2888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -118869,7 +118869,7 @@ stage: Modified - name: Modified2889 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg392\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118892,7 +118892,7 @@ stage: Modified - name: Modified2890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg392\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg392\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -118901,7 +118901,7 @@ stage: Modified - name: Modified2891 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg393\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118924,7 +118924,7 @@ stage: Modified - name: Modified2892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg393\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg393\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -118933,7 +118933,7 @@ stage: Modified - name: Modified2893 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg394\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118956,7 +118956,7 @@ stage: Modified - name: Modified2894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg394\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg394\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118964,7 +118964,7 @@ stage: Modified - name: Modified2895 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg395\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -118987,7 +118987,7 @@ stage: Modified - name: Modified2896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg395\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg395\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -118995,7 +118995,7 @@ stage: Modified - name: Modified2897 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg396\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119018,7 +119018,7 @@ stage: Modified - name: Modified2898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg396\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg396\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119027,7 +119027,7 @@ stage: Modified - name: Modified2899 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg397\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119050,7 +119050,7 @@ stage: Modified - name: Modified2900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg397\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg397\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119059,7 +119059,7 @@ stage: Modified - name: Modified2901 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg398\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119082,7 +119082,7 @@ stage: Modified - name: Modified2902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg398\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg398\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -119090,7 +119090,7 @@ stage: Modified - name: Modified2903 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg399\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119113,7 +119113,7 @@ stage: Modified - name: Modified2904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg399\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg399\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -119121,7 +119121,7 @@ stage: Modified - name: Modified2905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119130,7 +119130,7 @@ stage: Modified - name: Modified2906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119139,7 +119139,7 @@ stage: Modified - name: Modified2907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119148,7 +119148,7 @@ stage: Modified - name: Modified2908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119157,7 +119157,7 @@ stage: Modified - name: Modified2909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119166,7 +119166,7 @@ stage: Modified - name: Modified2910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -119174,7 +119174,7 @@ stage: Modified - name: Modified2911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119183,7 +119183,7 @@ stage: Modified - name: Modified2912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -119191,7 +119191,7 @@ stage: Modified - name: Modified2913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119200,7 +119200,7 @@ stage: Modified - name: Modified2914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119209,7 +119209,7 @@ stage: Modified - name: Modified2915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119218,7 +119218,7 @@ stage: Modified - name: Modified2916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119227,7 +119227,7 @@ stage: Modified - name: Modified2917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119236,7 +119236,7 @@ stage: Modified - name: Modified2918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -119244,7 +119244,7 @@ stage: Modified - name: Modified2919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769992,"checksum":"61a01d69982d6d5e993c30e046e701ef94aec6af"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119253,7 +119253,7 @@ stage: Modified - name: Modified2920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -119261,7 +119261,7 @@ stage: Modified - name: Modified2921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119270,7 +119270,7 @@ stage: Modified - name: Modified2922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg408\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119279,7 +119279,7 @@ stage: Modified - name: Modified2923 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119288,7 +119288,7 @@ stage: Modified - name: Modified2924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg409\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119297,7 +119297,7 @@ stage: Modified - name: Modified2925 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119306,7 +119306,7 @@ stage: Modified - name: Modified2926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg410\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -119314,7 +119314,7 @@ stage: Modified - name: Modified2927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119323,7 +119323,7 @@ stage: Modified - name: Modified2928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg411\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -119331,7 +119331,7 @@ stage: Modified - name: Modified2929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119340,7 +119340,7 @@ stage: Modified - name: Modified2930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg412\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119349,7 +119349,7 @@ stage: Modified - name: Modified2931 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119358,7 +119358,7 @@ stage: Modified - name: Modified2932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg413\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119367,7 +119367,7 @@ stage: Modified - name: Modified2933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119376,7 +119376,7 @@ stage: Modified - name: Modified2934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg414\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -119384,7 +119384,7 @@ stage: Modified - name: Modified2935 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key", "arch": "[x64]", "timestamp": 1606816872, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119393,7 +119393,7 @@ stage: Modified - name: Modified2936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg415\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -119401,7 +119401,7 @@ stage: Modified - name: Modified2937 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119423,7 +119423,7 @@ stage: Modified - name: Modified2938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119432,7 +119432,7 @@ stage: Modified - name: Modified2939 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119454,7 +119454,7 @@ stage: Modified - name: Modified2940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119463,7 +119463,7 @@ stage: Modified - name: Modified2941 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119485,7 +119485,7 @@ stage: Modified - name: Modified2942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -119493,7 +119493,7 @@ stage: Modified - name: Modified2943 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119515,7 +119515,7 @@ stage: Modified - name: Modified2944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -119523,7 +119523,7 @@ stage: Modified - name: Modified2945 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119545,7 +119545,7 @@ stage: Modified - name: Modified2946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119554,7 +119554,7 @@ stage: Modified - name: Modified2947 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119576,7 +119576,7 @@ stage: Modified - name: Modified2948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119585,7 +119585,7 @@ stage: Modified - name: Modified2949 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119607,7 +119607,7 @@ stage: Modified - name: Modified2950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -119615,7 +119615,7 @@ stage: Modified - name: Modified2951 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119637,7 +119637,7 @@ stage: Modified - name: Modified2952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -119645,7 +119645,7 @@ stage: Modified - name: Modified2953 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg424\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119667,7 +119667,7 @@ stage: Modified - name: Modified2954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg424\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg424\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119676,7 +119676,7 @@ stage: Modified - name: Modified2955 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg425\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816872,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119698,7 +119698,7 @@ stage: Modified - name: Modified2956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg425\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816872,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg425\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816872, "attributes": @@ -119707,7 +119707,7 @@ stage: Modified - name: Modified2957 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg426\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119729,7 +119729,7 @@ stage: Modified - name: Modified2958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg426\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg426\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -119737,7 +119737,7 @@ stage: Modified - name: Modified2959 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg427\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119759,7 +119759,7 @@ stage: Modified - name: Modified2960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg427\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg427\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -119767,7 +119767,7 @@ stage: Modified - name: Modified2961 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg428\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119789,7 +119789,7 @@ stage: Modified - name: Modified2962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg428\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg428\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -119798,7 +119798,7 @@ stage: Modified - name: Modified2963 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg429\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119820,7 +119820,7 @@ stage: Modified - name: Modified2964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg429\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg429\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -119829,7 +119829,7 @@ stage: Modified - name: Modified2965 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg430\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119851,7 +119851,7 @@ stage: Modified - name: Modified2966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg430\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg430\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -119859,7 +119859,7 @@ stage: Modified - name: Modified2967 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg431\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -119881,7 +119881,7 @@ stage: Modified - name: Modified2968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg431\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg431\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -119889,7 +119889,7 @@ stage: Modified - name: Modified2969 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119897,7 +119897,7 @@ stage: Modified - name: Modified2970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -119906,7 +119906,7 @@ stage: Modified - name: Modified2971 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119914,7 +119914,7 @@ stage: Modified - name: Modified2972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -119923,7 +119923,7 @@ stage: Modified - name: Modified2973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119931,7 +119931,7 @@ stage: Modified - name: Modified2974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -119939,7 +119939,7 @@ stage: Modified - name: Modified2975 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119947,7 +119947,7 @@ stage: Modified - name: Modified2976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -119955,7 +119955,7 @@ stage: Modified - name: Modified2977 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119963,7 +119963,7 @@ stage: Modified - name: Modified2978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -119972,7 +119972,7 @@ stage: Modified - name: Modified2979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119980,7 +119980,7 @@ stage: Modified - name: Modified2980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -119989,7 +119989,7 @@ stage: Modified - name: Modified2981 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -119997,7 +119997,7 @@ stage: Modified - name: Modified2982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120005,7 +120005,7 @@ stage: Modified - name: Modified2983 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769993,"checksum":"3aa2b990921430f9299cc1874cc1f141cab0da60"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -120013,7 +120013,7 @@ stage: Modified - name: Modified2984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120021,7 +120021,7 @@ stage: Modified - name: Modified2985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -120029,7 +120029,7 @@ stage: Modified - name: Modified2986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg440\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120038,7 +120038,7 @@ stage: Modified - name: Modified2987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -120046,7 +120046,7 @@ stage: Modified - name: Modified2988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg441\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120055,7 +120055,7 @@ stage: Modified - name: Modified2989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -120063,7 +120063,7 @@ stage: Modified - name: Modified2990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg442\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120071,7 +120071,7 @@ stage: Modified - name: Modified2991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -120079,7 +120079,7 @@ stage: Modified - name: Modified2992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg443\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120087,7 +120087,7 @@ stage: Modified - name: Modified2993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -120095,7 +120095,7 @@ stage: Modified - name: Modified2994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg444\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120104,7 +120104,7 @@ stage: Modified - name: Modified2995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -120112,7 +120112,7 @@ stage: Modified - name: Modified2996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg445\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120121,7 +120121,7 @@ stage: Modified - name: Modified2997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -120129,7 +120129,7 @@ stage: Modified - name: Modified2998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg446\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120137,7 +120137,7 @@ stage: Modified - name: Modified2999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -120145,7 +120145,7 @@ stage: Modified - name: Modified3000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg447\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120153,7 +120153,7 @@ stage: Modified - name: Modified3001 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120175,7 +120175,7 @@ stage: Modified - name: Modified3002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120184,7 +120184,7 @@ stage: Modified - name: Modified3003 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120206,7 +120206,7 @@ stage: Modified - name: Modified3004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120215,7 +120215,7 @@ stage: Modified - name: Modified3005 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120237,7 +120237,7 @@ stage: Modified - name: Modified3006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120245,7 +120245,7 @@ stage: Modified - name: Modified3007 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120267,7 +120267,7 @@ stage: Modified - name: Modified3008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120275,7 +120275,7 @@ stage: Modified - name: Modified3009 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120297,7 +120297,7 @@ stage: Modified - name: Modified3010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120306,7 +120306,7 @@ stage: Modified - name: Modified3011 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120328,7 +120328,7 @@ stage: Modified - name: Modified3012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120337,7 +120337,7 @@ stage: Modified - name: Modified3013 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120359,7 +120359,7 @@ stage: Modified - name: Modified3014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120367,7 +120367,7 @@ stage: Modified - name: Modified3015 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120389,7 +120389,7 @@ stage: Modified - name: Modified3016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120397,7 +120397,7 @@ stage: Modified - name: Modified3017 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg456\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120419,7 +120419,7 @@ stage: Modified - name: Modified3018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg456\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg456\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120428,7 +120428,7 @@ stage: Modified - name: Modified3019 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg457\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120450,7 +120450,7 @@ stage: Modified - name: Modified3020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg457\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg457\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120459,7 +120459,7 @@ stage: Modified - name: Modified3021 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg458\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120481,7 +120481,7 @@ stage: Modified - name: Modified3022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg458\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg458\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120489,7 +120489,7 @@ stage: Modified - name: Modified3023 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg459\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120511,7 +120511,7 @@ stage: Modified - name: Modified3024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg459\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg459\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120519,7 +120519,7 @@ stage: Modified - name: Modified3025 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg460\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120541,7 +120541,7 @@ stage: Modified - name: Modified3026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg460\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg460\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120550,7 +120550,7 @@ stage: Modified - name: Modified3027 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg461\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120572,7 +120572,7 @@ stage: Modified - name: Modified3028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg461\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg461\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120581,7 +120581,7 @@ stage: Modified - name: Modified3029 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg462\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120603,7 +120603,7 @@ stage: Modified - name: Modified3030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg462\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg462\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120611,7 +120611,7 @@ stage: Modified - name: Modified3031 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg463\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120633,7 +120633,7 @@ stage: Modified - name: Modified3032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg463\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg463\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120641,7 +120641,7 @@ stage: Modified - name: Modified3033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816873,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key", "arch": "[x64]", "timestamp": 1606816873, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -120649,7 +120649,7 @@ stage: Modified - name: Modified3034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816873,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816873, "attributes": @@ -120658,7 +120658,7 @@ stage: Modified - name: Modified3035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -120666,7 +120666,7 @@ stage: Modified - name: Modified3036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -120675,7 +120675,7 @@ stage: Modified - name: Modified3037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -120683,7 +120683,7 @@ stage: Modified - name: Modified3038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120691,7 +120691,7 @@ stage: Modified - name: Modified3039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -120699,7 +120699,7 @@ stage: Modified - name: Modified3040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120707,7 +120707,7 @@ stage: Modified - name: Modified3041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -120715,7 +120715,7 @@ stage: Modified - name: Modified3042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -120724,7 +120724,7 @@ stage: Modified - name: Modified3043 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -120732,7 +120732,7 @@ stage: Modified - name: Modified3044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -120741,7 +120741,7 @@ stage: Modified - name: Modified3045 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -120749,7 +120749,7 @@ stage: Modified - name: Modified3046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120757,7 +120757,7 @@ stage: Modified - name: Modified3047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769993,"checksum":"7062af02343d32b01ebf3d7404d9e4741d7137c2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -120765,7 +120765,7 @@ stage: Modified - name: Modified3048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120773,7 +120773,7 @@ stage: Modified - name: Modified3049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg472\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg472\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -120782,7 +120782,7 @@ stage: Modified - name: Modified3050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg473\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg473\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -120791,7 +120791,7 @@ stage: Modified - name: Modified3051 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg474\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg474\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120799,7 +120799,7 @@ stage: Modified - name: Modified3052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg475\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg475\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120807,7 +120807,7 @@ stage: Modified - name: Modified3053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg476\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg476\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -120816,7 +120816,7 @@ stage: Modified - name: Modified3054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg477\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg477\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -120825,7 +120825,7 @@ stage: Modified - name: Modified3055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg478\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg478\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120833,7 +120833,7 @@ stage: Modified - name: Modified3056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg479\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg479\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -120841,7 +120841,7 @@ stage: Modified - name: Modified3057 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120862,7 +120862,7 @@ stage: Modified - name: Modified3058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -120871,7 +120871,7 @@ stage: Modified - name: Modified3059 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120892,7 +120892,7 @@ stage: Modified - name: Modified3060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -120901,7 +120901,7 @@ stage: Modified - name: Modified3061 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120922,7 +120922,7 @@ stage: Modified - name: Modified3062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120930,7 +120930,7 @@ stage: Modified - name: Modified3063 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120951,7 +120951,7 @@ stage: Modified - name: Modified3064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -120959,7 +120959,7 @@ stage: Modified - name: Modified3065 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -120980,7 +120980,7 @@ stage: Modified - name: Modified3066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -120989,7 +120989,7 @@ stage: Modified - name: Modified3067 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121010,7 +121010,7 @@ stage: Modified - name: Modified3068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -121019,7 +121019,7 @@ stage: Modified - name: Modified3069 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121040,7 +121040,7 @@ stage: Modified - name: Modified3070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -121048,7 +121048,7 @@ stage: Modified - name: Modified3071 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121069,7 +121069,7 @@ stage: Modified - name: Modified3072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -121077,7 +121077,7 @@ stage: Modified - name: Modified3073 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg488\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121098,7 +121098,7 @@ stage: Modified - name: Modified3074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg488\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg488\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -121107,7 +121107,7 @@ stage: Modified - name: Modified3075 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg489\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121128,7 +121128,7 @@ stage: Modified - name: Modified3076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg489\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg489\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -121137,7 +121137,7 @@ stage: Modified - name: Modified3077 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg490\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121158,7 +121158,7 @@ stage: Modified - name: Modified3078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg490\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg490\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -121166,7 +121166,7 @@ stage: Modified - name: Modified3079 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg491\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121187,7 +121187,7 @@ stage: Modified - name: Modified3080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg491\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg491\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -121195,7 +121195,7 @@ stage: Modified - name: Modified3081 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg492\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121216,7 +121216,7 @@ stage: Modified - name: Modified3082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg492\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg492\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -121225,7 +121225,7 @@ stage: Modified - name: Modified3083 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg493\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121246,7 +121246,7 @@ stage: Modified - name: Modified3084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg493\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg493\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -121255,7 +121255,7 @@ stage: Modified - name: Modified3085 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg494\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121276,7 +121276,7 @@ stage: Modified - name: Modified3086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg494\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg494\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -121284,7 +121284,7 @@ stage: Modified - name: Modified3087 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg495\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121305,7 +121305,7 @@ stage: Modified - name: Modified3088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg495\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg495\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -121313,14 +121313,14 @@ stage: Modified - name: Modified3089 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "mtime": 1606769994, "checksum": "87d00eb10bcf57cefd7b03d5cfab1d44c4965606"}}' stage: Modified - name: Modified3090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -121329,14 +121329,14 @@ stage: Modified - name: Modified3091 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "mtime": 1606769994, "checksum": "87d00eb10bcf57cefd7b03d5cfab1d44c4965606"}}' stage: Modified - name: Modified3092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -121345,14 +121345,14 @@ stage: Modified - name: Modified3093 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "mtime": 1606769994, "checksum": "87d00eb10bcf57cefd7b03d5cfab1d44c4965606"}}' stage: Modified - name: Modified3094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -121360,14 +121360,14 @@ stage: Modified - name: Modified3095 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "mtime": 1606769994, "checksum": "87d00eb10bcf57cefd7b03d5cfab1d44c4965606"}}' stage: Modified - name: Modified3096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -121375,14 +121375,14 @@ stage: Modified - name: Modified3097 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "mtime": 1606769994, "checksum": "87d00eb10bcf57cefd7b03d5cfab1d44c4965606"}}' stage: Modified - name: Modified3098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -121391,14 +121391,14 @@ stage: Modified - name: Modified3099 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816874,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key", "arch": "[x64]", "timestamp": 1606816874, "attributes": {"type": "registry_key", "mtime": 1606769994, "checksum": "87d00eb10bcf57cefd7b03d5cfab1d44c4965606"}}' stage: Modified - name: Modified3100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816874,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816874, "attributes": @@ -121407,14 +121407,14 @@ stage: Modified - name: Modified3101 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "mtime": 1606769994, "checksum": "87d00eb10bcf57cefd7b03d5cfab1d44c4965606"}}' stage: Modified - name: Modified3102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -121422,14 +121422,14 @@ stage: Modified - name: Modified3103 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","mtime":1606769994,"checksum":"87d00eb10bcf57cefd7b03d5cfab1d44c4965606"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "mtime": 1606769994, "checksum": "87d00eb10bcf57cefd7b03d5cfab1d44c4965606"}}' stage: Modified - name: Modified3104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -121437,7 +121437,7 @@ stage: Modified - name: Modified3105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg504\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg504\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121446,7 +121446,7 @@ stage: Modified - name: Modified3106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg505\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg505\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121455,7 +121455,7 @@ stage: Modified - name: Modified3107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg506\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg506\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -121463,7 +121463,7 @@ stage: Modified - name: Modified3108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg507\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg507\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -121471,7 +121471,7 @@ stage: Modified - name: Modified3109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg508\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg508\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121480,7 +121480,7 @@ stage: Modified - name: Modified3110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg509\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg509\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121489,7 +121489,7 @@ stage: Modified - name: Modified3111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg510\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg510\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -121497,7 +121497,7 @@ stage: Modified - name: Modified3112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg511\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg511\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -121505,7 +121505,7 @@ stage: Modified - name: Modified3113 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121528,7 +121528,7 @@ stage: Modified - name: Modified3114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121538,7 +121538,7 @@ stage: Modified - name: Modified3115 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121561,7 +121561,7 @@ stage: Modified - name: Modified3116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121571,7 +121571,7 @@ stage: Modified - name: Modified3117 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121594,7 +121594,7 @@ stage: Modified - name: Modified3118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -121603,7 +121603,7 @@ stage: Modified - name: Modified3119 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121626,7 +121626,7 @@ stage: Modified - name: Modified3120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -121635,7 +121635,7 @@ stage: Modified - name: Modified3121 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121658,7 +121658,7 @@ stage: Modified - name: Modified3122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121668,7 +121668,7 @@ stage: Modified - name: Modified3123 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121691,7 +121691,7 @@ stage: Modified - name: Modified3124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121701,7 +121701,7 @@ stage: Modified - name: Modified3125 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121724,7 +121724,7 @@ stage: Modified - name: Modified3126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -121733,7 +121733,7 @@ stage: Modified - name: Modified3127 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121756,7 +121756,7 @@ stage: Modified - name: Modified3128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -121765,7 +121765,7 @@ stage: Modified - name: Modified3129 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg520\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121788,7 +121788,7 @@ stage: Modified - name: Modified3130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg520\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg520\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121798,7 +121798,7 @@ stage: Modified - name: Modified3131 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg521\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121821,7 +121821,7 @@ stage: Modified - name: Modified3132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg521\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg521\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121831,7 +121831,7 @@ stage: Modified - name: Modified3133 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg522\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121854,7 +121854,7 @@ stage: Modified - name: Modified3134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg522\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg522\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -121863,7 +121863,7 @@ stage: Modified - name: Modified3135 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg523\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121886,7 +121886,7 @@ stage: Modified - name: Modified3136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg523\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg523\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -121895,7 +121895,7 @@ stage: Modified - name: Modified3137 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg524\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121918,7 +121918,7 @@ stage: Modified - name: Modified3138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg524\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg524\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121928,7 +121928,7 @@ stage: Modified - name: Modified3139 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg525\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121951,7 +121951,7 @@ stage: Modified - name: Modified3140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg525\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg525\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -121961,7 +121961,7 @@ stage: Modified - name: Modified3141 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg526\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -121984,7 +121984,7 @@ stage: Modified - name: Modified3142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg526\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg526\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -121993,7 +121993,7 @@ stage: Modified - name: Modified3143 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg527\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122016,7 +122016,7 @@ stage: Modified - name: Modified3144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg527\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg527\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122025,7 +122025,7 @@ stage: Modified - name: Modified3145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122034,7 +122034,7 @@ stage: Modified - name: Modified3146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -122044,7 +122044,7 @@ stage: Modified - name: Modified3147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122053,7 +122053,7 @@ stage: Modified - name: Modified3148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -122063,7 +122063,7 @@ stage: Modified - name: Modified3149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122072,7 +122072,7 @@ stage: Modified - name: Modified3150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122081,7 +122081,7 @@ stage: Modified - name: Modified3151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122090,7 +122090,7 @@ stage: Modified - name: Modified3152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122099,7 +122099,7 @@ stage: Modified - name: Modified3153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122108,7 +122108,7 @@ stage: Modified - name: Modified3154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -122118,7 +122118,7 @@ stage: Modified - name: Modified3155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122127,7 +122127,7 @@ stage: Modified - name: Modified3156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -122137,7 +122137,7 @@ stage: Modified - name: Modified3157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122146,7 +122146,7 @@ stage: Modified - name: Modified3158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122155,7 +122155,7 @@ stage: Modified - name: Modified3159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769994,"checksum":"743ed219f9fece706542085631f1d0858eac52ea"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122164,7 +122164,7 @@ stage: Modified - name: Modified3160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122173,7 +122173,7 @@ stage: Modified - name: Modified3161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122182,7 +122182,7 @@ stage: Modified - name: Modified3162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg536\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -122192,7 +122192,7 @@ stage: Modified - name: Modified3163 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816875,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key", "arch": "[x64]", "timestamp": 1606816875, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122201,7 +122201,7 @@ stage: Modified - name: Modified3164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816875,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg537\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816875, "attributes": @@ -122211,7 +122211,7 @@ stage: Modified - name: Modified3165 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122220,7 +122220,7 @@ stage: Modified - name: Modified3166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg538\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122229,7 +122229,7 @@ stage: Modified - name: Modified3167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122238,7 +122238,7 @@ stage: Modified - name: Modified3168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg539\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122247,7 +122247,7 @@ stage: Modified - name: Modified3169 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122256,7 +122256,7 @@ stage: Modified - name: Modified3170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg540\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122266,7 +122266,7 @@ stage: Modified - name: Modified3171 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122275,7 +122275,7 @@ stage: Modified - name: Modified3172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg541\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122285,7 +122285,7 @@ stage: Modified - name: Modified3173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122294,7 +122294,7 @@ stage: Modified - name: Modified3174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg542\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122303,7 +122303,7 @@ stage: Modified - name: Modified3175 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122312,7 +122312,7 @@ stage: Modified - name: Modified3176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg543\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122321,7 +122321,7 @@ stage: Modified - name: Modified3177 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122343,7 +122343,7 @@ stage: Modified - name: Modified3178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122353,7 +122353,7 @@ stage: Modified - name: Modified3179 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122375,7 +122375,7 @@ stage: Modified - name: Modified3180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122385,7 +122385,7 @@ stage: Modified - name: Modified3181 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122407,7 +122407,7 @@ stage: Modified - name: Modified3182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122416,7 +122416,7 @@ stage: Modified - name: Modified3183 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122438,7 +122438,7 @@ stage: Modified - name: Modified3184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122447,7 +122447,7 @@ stage: Modified - name: Modified3185 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122469,7 +122469,7 @@ stage: Modified - name: Modified3186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122479,7 +122479,7 @@ stage: Modified - name: Modified3187 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122501,7 +122501,7 @@ stage: Modified - name: Modified3188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122511,7 +122511,7 @@ stage: Modified - name: Modified3189 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122533,7 +122533,7 @@ stage: Modified - name: Modified3190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122542,7 +122542,7 @@ stage: Modified - name: Modified3191 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122564,7 +122564,7 @@ stage: Modified - name: Modified3192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122573,7 +122573,7 @@ stage: Modified - name: Modified3193 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg552\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122595,7 +122595,7 @@ stage: Modified - name: Modified3194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg552\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg552\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122605,7 +122605,7 @@ stage: Modified - name: Modified3195 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg553\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122627,7 +122627,7 @@ stage: Modified - name: Modified3196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg553\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg553\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122637,7 +122637,7 @@ stage: Modified - name: Modified3197 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg554\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122659,7 +122659,7 @@ stage: Modified - name: Modified3198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg554\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg554\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122668,7 +122668,7 @@ stage: Modified - name: Modified3199 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg555\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122690,7 +122690,7 @@ stage: Modified - name: Modified3200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg555\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg555\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122699,7 +122699,7 @@ stage: Modified - name: Modified3201 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg556\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122721,7 +122721,7 @@ stage: Modified - name: Modified3202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg556\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg556\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122731,7 +122731,7 @@ stage: Modified - name: Modified3203 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg557\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122753,7 +122753,7 @@ stage: Modified - name: Modified3204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg557\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg557\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122763,7 +122763,7 @@ stage: Modified - name: Modified3205 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg558\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122785,7 +122785,7 @@ stage: Modified - name: Modified3206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg558\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg558\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122794,7 +122794,7 @@ stage: Modified - name: Modified3207 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg559\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -122816,7 +122816,7 @@ stage: Modified - name: Modified3208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg559\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg559\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122825,7 +122825,7 @@ stage: Modified - name: Modified3209 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122833,7 +122833,7 @@ stage: Modified - name: Modified3210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122843,7 +122843,7 @@ stage: Modified - name: Modified3211 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122851,7 +122851,7 @@ stage: Modified - name: Modified3212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122861,7 +122861,7 @@ stage: Modified - name: Modified3213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122869,7 +122869,7 @@ stage: Modified - name: Modified3214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122878,7 +122878,7 @@ stage: Modified - name: Modified3215 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122886,7 +122886,7 @@ stage: Modified - name: Modified3216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122895,7 +122895,7 @@ stage: Modified - name: Modified3217 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122903,7 +122903,7 @@ stage: Modified - name: Modified3218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122913,7 +122913,7 @@ stage: Modified - name: Modified3219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122921,7 +122921,7 @@ stage: Modified - name: Modified3220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122931,7 +122931,7 @@ stage: Modified - name: Modified3221 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122939,7 +122939,7 @@ stage: Modified - name: Modified3222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122948,7 +122948,7 @@ stage: Modified - name: Modified3223 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769995,"checksum":"8cb11c1d34942bd4bcce2aee27260931f5466214"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122956,7 +122956,7 @@ stage: Modified - name: Modified3224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -122965,7 +122965,7 @@ stage: Modified - name: Modified3225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122973,7 +122973,7 @@ stage: Modified - name: Modified3226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg568\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -122983,7 +122983,7 @@ stage: Modified - name: Modified3227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -122991,7 +122991,7 @@ stage: Modified - name: Modified3228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg569\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -123001,7 +123001,7 @@ stage: Modified - name: Modified3229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -123009,7 +123009,7 @@ stage: Modified - name: Modified3230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg570\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123018,7 +123018,7 @@ stage: Modified - name: Modified3231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -123026,7 +123026,7 @@ stage: Modified - name: Modified3232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg571\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123035,7 +123035,7 @@ stage: Modified - name: Modified3233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816876,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key", "arch": "[x64]", "timestamp": 1606816876, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -123043,7 +123043,7 @@ stage: Modified - name: Modified3234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816876,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg572\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816876, "attributes": @@ -123053,7 +123053,7 @@ stage: Modified - name: Modified3235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key", "arch": "[x64]", "timestamp": 1606816877, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -123061,7 +123061,7 @@ stage: Modified - name: Modified3236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg573\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123071,7 +123071,7 @@ stage: Modified - name: Modified3237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key", "arch": "[x64]", "timestamp": 1606816877, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -123079,7 +123079,7 @@ stage: Modified - name: Modified3238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg574\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123088,7 +123088,7 @@ stage: Modified - name: Modified3239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key", "arch": "[x64]", "timestamp": 1606816877, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -123096,7 +123096,7 @@ stage: Modified - name: Modified3240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg575\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123105,7 +123105,7 @@ stage: Modified - name: Modified3241 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123127,7 +123127,7 @@ stage: Modified - name: Modified3242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123137,7 +123137,7 @@ stage: Modified - name: Modified3243 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123159,7 +123159,7 @@ stage: Modified - name: Modified3244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123169,7 +123169,7 @@ stage: Modified - name: Modified3245 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123191,7 +123191,7 @@ stage: Modified - name: Modified3246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123200,7 +123200,7 @@ stage: Modified - name: Modified3247 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123222,7 +123222,7 @@ stage: Modified - name: Modified3248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123231,7 +123231,7 @@ stage: Modified - name: Modified3249 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123253,7 +123253,7 @@ stage: Modified - name: Modified3250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123263,7 +123263,7 @@ stage: Modified - name: Modified3251 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123285,7 +123285,7 @@ stage: Modified - name: Modified3252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123295,7 +123295,7 @@ stage: Modified - name: Modified3253 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123317,7 +123317,7 @@ stage: Modified - name: Modified3254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123326,7 +123326,7 @@ stage: Modified - name: Modified3255 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123348,7 +123348,7 @@ stage: Modified - name: Modified3256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123357,7 +123357,7 @@ stage: Modified - name: Modified3257 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg584\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123379,7 +123379,7 @@ stage: Modified - name: Modified3258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg584\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg584\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123389,7 +123389,7 @@ stage: Modified - name: Modified3259 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg585\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123411,7 +123411,7 @@ stage: Modified - name: Modified3260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg585\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg585\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123421,7 +123421,7 @@ stage: Modified - name: Modified3261 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg586\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123443,7 +123443,7 @@ stage: Modified - name: Modified3262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg586\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg586\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123452,7 +123452,7 @@ stage: Modified - name: Modified3263 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg587\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123474,7 +123474,7 @@ stage: Modified - name: Modified3264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg587\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg587\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123483,7 +123483,7 @@ stage: Modified - name: Modified3265 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg588\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123505,7 +123505,7 @@ stage: Modified - name: Modified3266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg588\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg588\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123515,7 +123515,7 @@ stage: Modified - name: Modified3267 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg589\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123537,7 +123537,7 @@ stage: Modified - name: Modified3268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg589\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg589\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123547,7 +123547,7 @@ stage: Modified - name: Modified3269 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg590\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123569,7 +123569,7 @@ stage: Modified - name: Modified3270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg590\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg590\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123578,7 +123578,7 @@ stage: Modified - name: Modified3271 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg591\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123600,7 +123600,7 @@ stage: Modified - name: Modified3272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg591\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg591\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123609,7 +123609,7 @@ stage: Modified - name: Modified3273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key", "arch": "[x64]", "timestamp": 1606816877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -123617,7 +123617,7 @@ stage: Modified - name: Modified3274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123627,7 +123627,7 @@ stage: Modified - name: Modified3275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key", "arch": "[x64]", "timestamp": 1606816877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -123635,7 +123635,7 @@ stage: Modified - name: Modified3276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123645,7 +123645,7 @@ stage: Modified - name: Modified3277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key", "arch": "[x64]", "timestamp": 1606816877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -123653,7 +123653,7 @@ stage: Modified - name: Modified3278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123662,7 +123662,7 @@ stage: Modified - name: Modified3279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key", "arch": "[x64]", "timestamp": 1606816877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -123670,7 +123670,7 @@ stage: Modified - name: Modified3280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123679,7 +123679,7 @@ stage: Modified - name: Modified3281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key", "arch": "[x64]", "timestamp": 1606816877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -123687,7 +123687,7 @@ stage: Modified - name: Modified3282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123697,7 +123697,7 @@ stage: Modified - name: Modified3283 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key", "arch": "[x64]", "timestamp": 1606816877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -123705,7 +123705,7 @@ stage: Modified - name: Modified3284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123715,7 +123715,7 @@ stage: Modified - name: Modified3285 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key", "arch": "[x64]", "timestamp": 1606816877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -123723,7 +123723,7 @@ stage: Modified - name: Modified3286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123732,7 +123732,7 @@ stage: Modified - name: Modified3287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769995,"checksum":"e885331f7536510a9c89fdf8d3ff915c47e0f7b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key", "arch": "[x64]", "timestamp": 1606816877, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -123740,7 +123740,7 @@ stage: Modified - name: Modified3288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123749,7 +123749,7 @@ stage: Modified - name: Modified3289 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg600\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg600\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123759,7 +123759,7 @@ stage: Modified - name: Modified3290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg601\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg601\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123769,7 +123769,7 @@ stage: Modified - name: Modified3291 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg602\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg602\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123778,7 +123778,7 @@ stage: Modified - name: Modified3292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg603\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg603\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123787,7 +123787,7 @@ stage: Modified - name: Modified3293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg604\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg604\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123797,7 +123797,7 @@ stage: Modified - name: Modified3294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg605\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg605\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123807,7 +123807,7 @@ stage: Modified - name: Modified3295 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg606\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg606\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123816,7 +123816,7 @@ stage: Modified - name: Modified3296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg607\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg607\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123825,7 +123825,7 @@ stage: Modified - name: Modified3297 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816877,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123846,7 +123846,7 @@ stage: Modified - name: Modified3298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816877,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816877, "attributes": @@ -123856,7 +123856,7 @@ stage: Modified - name: Modified3299 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123877,7 +123877,7 @@ stage: Modified - name: Modified3300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -123887,7 +123887,7 @@ stage: Modified - name: Modified3301 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123908,7 +123908,7 @@ stage: Modified - name: Modified3302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123917,7 +123917,7 @@ stage: Modified - name: Modified3303 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123938,7 +123938,7 @@ stage: Modified - name: Modified3304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -123947,7 +123947,7 @@ stage: Modified - name: Modified3305 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123968,7 +123968,7 @@ stage: Modified - name: Modified3306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -123978,7 +123978,7 @@ stage: Modified - name: Modified3307 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -123999,7 +123999,7 @@ stage: Modified - name: Modified3308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124009,7 +124009,7 @@ stage: Modified - name: Modified3309 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124030,7 +124030,7 @@ stage: Modified - name: Modified3310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124039,7 +124039,7 @@ stage: Modified - name: Modified3311 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124060,7 +124060,7 @@ stage: Modified - name: Modified3312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124069,7 +124069,7 @@ stage: Modified - name: Modified3313 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg616\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124090,7 +124090,7 @@ stage: Modified - name: Modified3314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg616\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg616\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124100,7 +124100,7 @@ stage: Modified - name: Modified3315 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg617\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124121,7 +124121,7 @@ stage: Modified - name: Modified3316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg617\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg617\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124131,7 +124131,7 @@ stage: Modified - name: Modified3317 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg618\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124152,7 +124152,7 @@ stage: Modified - name: Modified3318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg618\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg618\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124161,7 +124161,7 @@ stage: Modified - name: Modified3319 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg619\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124182,7 +124182,7 @@ stage: Modified - name: Modified3320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg619\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg619\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124191,7 +124191,7 @@ stage: Modified - name: Modified3321 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg620\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124212,7 +124212,7 @@ stage: Modified - name: Modified3322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg620\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg620\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124222,7 +124222,7 @@ stage: Modified - name: Modified3323 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg621\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124243,7 +124243,7 @@ stage: Modified - name: Modified3324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg621\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg621\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124253,7 +124253,7 @@ stage: Modified - name: Modified3325 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg622\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124274,7 +124274,7 @@ stage: Modified - name: Modified3326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg622\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg622\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124283,7 +124283,7 @@ stage: Modified - name: Modified3327 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg623\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124304,7 +124304,7 @@ stage: Modified - name: Modified3328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg623\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg623\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124313,14 +124313,14 @@ stage: Modified - name: Modified3329 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key", "arch": "[x64]", "timestamp": 1606816878, "attributes": {"type": "registry_key", "mtime": 1606769996, "checksum": "45f0f12f21062efd6f3938cb945cd1ed0d66ff02"}}' stage: Modified - name: Modified3330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124330,14 +124330,14 @@ stage: Modified - name: Modified3331 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key", "arch": "[x64]", "timestamp": 1606816878, "attributes": {"type": "registry_key", "mtime": 1606769996, "checksum": "45f0f12f21062efd6f3938cb945cd1ed0d66ff02"}}' stage: Modified - name: Modified3332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124347,14 +124347,14 @@ stage: Modified - name: Modified3333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key", "arch": "[x64]", "timestamp": 1606816878, "attributes": {"type": "registry_key", "mtime": 1606769996, "checksum": "45f0f12f21062efd6f3938cb945cd1ed0d66ff02"}}' stage: Modified - name: Modified3334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124363,14 +124363,14 @@ stage: Modified - name: Modified3335 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key", "arch": "[x64]", "timestamp": 1606816878, "attributes": {"type": "registry_key", "mtime": 1606769996, "checksum": "45f0f12f21062efd6f3938cb945cd1ed0d66ff02"}}' stage: Modified - name: Modified3336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124379,14 +124379,14 @@ stage: Modified - name: Modified3337 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key", "arch": "[x64]", "timestamp": 1606816878, "attributes": {"type": "registry_key", "mtime": 1606769996, "checksum": "45f0f12f21062efd6f3938cb945cd1ed0d66ff02"}}' stage: Modified - name: Modified3338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124396,14 +124396,14 @@ stage: Modified - name: Modified3339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key", "arch": "[x64]", "timestamp": 1606816878, "attributes": {"type": "registry_key", "mtime": 1606769996, "checksum": "45f0f12f21062efd6f3938cb945cd1ed0d66ff02"}}' stage: Modified - name: Modified3340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124413,14 +124413,14 @@ stage: Modified - name: Modified3341 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key", "arch": "[x64]", "timestamp": 1606816878, "attributes": {"type": "registry_key", "mtime": 1606769996, "checksum": "45f0f12f21062efd6f3938cb945cd1ed0d66ff02"}}' stage: Modified - name: Modified3342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124429,14 +124429,14 @@ stage: Modified - name: Modified3343 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","mtime":1606769996,"checksum":"45f0f12f21062efd6f3938cb945cd1ed0d66ff02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key", "arch": "[x64]", "timestamp": 1606816878, "attributes": {"type": "registry_key", "mtime": 1606769996, "checksum": "45f0f12f21062efd6f3938cb945cd1ed0d66ff02"}}' stage: Modified - name: Modified3344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124445,7 +124445,7 @@ stage: Modified - name: Modified3345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg632\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg632\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124455,7 +124455,7 @@ stage: Modified - name: Modified3346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg633\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg633\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124465,7 +124465,7 @@ stage: Modified - name: Modified3347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg634\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg634\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124474,7 +124474,7 @@ stage: Modified - name: Modified3348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg635\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg635\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124483,7 +124483,7 @@ stage: Modified - name: Modified3349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg636\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg636\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124493,7 +124493,7 @@ stage: Modified - name: Modified3350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg637\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg637\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124503,7 +124503,7 @@ stage: Modified - name: Modified3351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg638\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg638\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124512,7 +124512,7 @@ stage: Modified - name: Modified3352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg639\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg639\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124521,7 +124521,7 @@ stage: Modified - name: Modified3353 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124544,7 +124544,7 @@ stage: Modified - name: Modified3354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124554,7 +124554,7 @@ stage: Modified - name: Modified3355 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124577,7 +124577,7 @@ stage: Modified - name: Modified3356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124587,7 +124587,7 @@ stage: Modified - name: Modified3357 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124610,7 +124610,7 @@ stage: Modified - name: Modified3358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124619,7 +124619,7 @@ stage: Modified - name: Modified3359 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124642,7 +124642,7 @@ stage: Modified - name: Modified3360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124651,7 +124651,7 @@ stage: Modified - name: Modified3361 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816878,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124674,7 +124674,7 @@ stage: Modified - name: Modified3362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816878,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816878, "attributes": @@ -124684,7 +124684,7 @@ stage: Modified - name: Modified3363 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124707,7 +124707,7 @@ stage: Modified - name: Modified3364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -124717,7 +124717,7 @@ stage: Modified - name: Modified3365 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124740,7 +124740,7 @@ stage: Modified - name: Modified3366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124749,7 +124749,7 @@ stage: Modified - name: Modified3367 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124772,7 +124772,7 @@ stage: Modified - name: Modified3368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124781,7 +124781,7 @@ stage: Modified - name: Modified3369 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg648\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124804,7 +124804,7 @@ stage: Modified - name: Modified3370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg648\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg648\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -124814,7 +124814,7 @@ stage: Modified - name: Modified3371 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg649\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124837,7 +124837,7 @@ stage: Modified - name: Modified3372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg649\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg649\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -124847,7 +124847,7 @@ stage: Modified - name: Modified3373 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg650\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124870,7 +124870,7 @@ stage: Modified - name: Modified3374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg650\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg650\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124879,7 +124879,7 @@ stage: Modified - name: Modified3375 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg651\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124902,7 +124902,7 @@ stage: Modified - name: Modified3376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg651\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg651\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -124911,7 +124911,7 @@ stage: Modified - name: Modified3377 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg652\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124934,7 +124934,7 @@ stage: Modified - name: Modified3378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg652\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg652\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -124944,7 +124944,7 @@ stage: Modified - name: Modified3379 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg653\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -124967,7 +124967,7 @@ stage: Modified - name: Modified3380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg653\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg653\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -124977,7 +124977,7 @@ stage: Modified - name: Modified3381 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg654\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125000,7 +125000,7 @@ stage: Modified - name: Modified3382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg654\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg654\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125009,7 +125009,7 @@ stage: Modified - name: Modified3383 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg655\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125032,7 +125032,7 @@ stage: Modified - name: Modified3384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg655\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg655\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125041,7 +125041,7 @@ stage: Modified - name: Modified3385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125050,7 +125050,7 @@ stage: Modified - name: Modified3386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125060,7 +125060,7 @@ stage: Modified - name: Modified3387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125069,7 +125069,7 @@ stage: Modified - name: Modified3388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125079,7 +125079,7 @@ stage: Modified - name: Modified3389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125088,7 +125088,7 @@ stage: Modified - name: Modified3390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125097,7 +125097,7 @@ stage: Modified - name: Modified3391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125106,7 +125106,7 @@ stage: Modified - name: Modified3392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125115,7 +125115,7 @@ stage: Modified - name: Modified3393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125124,7 +125124,7 @@ stage: Modified - name: Modified3394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125134,7 +125134,7 @@ stage: Modified - name: Modified3395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125143,7 +125143,7 @@ stage: Modified - name: Modified3396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125153,7 +125153,7 @@ stage: Modified - name: Modified3397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125162,7 +125162,7 @@ stage: Modified - name: Modified3398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125171,7 +125171,7 @@ stage: Modified - name: Modified3399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769996,"checksum":"e7a568a61d72df37ed27071be259371031c938d7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125180,7 +125180,7 @@ stage: Modified - name: Modified3400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125189,7 +125189,7 @@ stage: Modified - name: Modified3401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125198,7 +125198,7 @@ stage: Modified - name: Modified3402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg664\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125208,7 +125208,7 @@ stage: Modified - name: Modified3403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125217,7 +125217,7 @@ stage: Modified - name: Modified3404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg665\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125227,7 +125227,7 @@ stage: Modified - name: Modified3405 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125236,7 +125236,7 @@ stage: Modified - name: Modified3406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg666\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125245,7 +125245,7 @@ stage: Modified - name: Modified3407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125254,7 +125254,7 @@ stage: Modified - name: Modified3408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg667\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125263,7 +125263,7 @@ stage: Modified - name: Modified3409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125272,7 +125272,7 @@ stage: Modified - name: Modified3410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg668\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125282,7 +125282,7 @@ stage: Modified - name: Modified3411 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125291,7 +125291,7 @@ stage: Modified - name: Modified3412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg669\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125301,7 +125301,7 @@ stage: Modified - name: Modified3413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125310,7 +125310,7 @@ stage: Modified - name: Modified3414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg670\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125319,7 +125319,7 @@ stage: Modified - name: Modified3415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key", "arch": "[x64]", "timestamp": 1606816879, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125328,7 +125328,7 @@ stage: Modified - name: Modified3416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg671\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125337,7 +125337,7 @@ stage: Modified - name: Modified3417 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125359,7 +125359,7 @@ stage: Modified - name: Modified3418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125369,7 +125369,7 @@ stage: Modified - name: Modified3419 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125391,7 +125391,7 @@ stage: Modified - name: Modified3420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125401,7 +125401,7 @@ stage: Modified - name: Modified3421 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125423,7 +125423,7 @@ stage: Modified - name: Modified3422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125432,7 +125432,7 @@ stage: Modified - name: Modified3423 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125454,7 +125454,7 @@ stage: Modified - name: Modified3424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125463,7 +125463,7 @@ stage: Modified - name: Modified3425 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125485,7 +125485,7 @@ stage: Modified - name: Modified3426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125495,7 +125495,7 @@ stage: Modified - name: Modified3427 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816879,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125517,7 +125517,7 @@ stage: Modified - name: Modified3428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816879,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816879, "attributes": @@ -125527,7 +125527,7 @@ stage: Modified - name: Modified3429 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125549,7 +125549,7 @@ stage: Modified - name: Modified3430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125558,7 +125558,7 @@ stage: Modified - name: Modified3431 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125580,7 +125580,7 @@ stage: Modified - name: Modified3432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125589,7 +125589,7 @@ stage: Modified - name: Modified3433 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg680\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125611,7 +125611,7 @@ stage: Modified - name: Modified3434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg680\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg680\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -125621,7 +125621,7 @@ stage: Modified - name: Modified3435 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg681\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125643,7 +125643,7 @@ stage: Modified - name: Modified3436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg681\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg681\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -125653,7 +125653,7 @@ stage: Modified - name: Modified3437 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg682\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125675,7 +125675,7 @@ stage: Modified - name: Modified3438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg682\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg682\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125684,7 +125684,7 @@ stage: Modified - name: Modified3439 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg683\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125706,7 +125706,7 @@ stage: Modified - name: Modified3440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg683\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg683\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125715,7 +125715,7 @@ stage: Modified - name: Modified3441 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg684\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125737,7 +125737,7 @@ stage: Modified - name: Modified3442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg684\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg684\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -125747,7 +125747,7 @@ stage: Modified - name: Modified3443 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg685\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125769,7 +125769,7 @@ stage: Modified - name: Modified3444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg685\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg685\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -125779,7 +125779,7 @@ stage: Modified - name: Modified3445 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg686\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125801,7 +125801,7 @@ stage: Modified - name: Modified3446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg686\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg686\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125810,7 +125810,7 @@ stage: Modified - name: Modified3447 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg687\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -125832,7 +125832,7 @@ stage: Modified - name: Modified3448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg687\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg687\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125841,7 +125841,7 @@ stage: Modified - name: Modified3449 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769996,"checksum":"d6bc2dee19e0c1f5c148b973cc4c02da9f61882a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769996,"checksum":"d6bc2dee19e0c1f5c148b973cc4c02da9f61882a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125849,7 +125849,7 @@ stage: Modified - name: Modified3450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -125859,7 +125859,7 @@ stage: Modified - name: Modified3451 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125867,7 +125867,7 @@ stage: Modified - name: Modified3452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -125877,7 +125877,7 @@ stage: Modified - name: Modified3453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125885,7 +125885,7 @@ stage: Modified - name: Modified3454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125894,7 +125894,7 @@ stage: Modified - name: Modified3455 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125902,7 +125902,7 @@ stage: Modified - name: Modified3456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125911,7 +125911,7 @@ stage: Modified - name: Modified3457 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125919,7 +125919,7 @@ stage: Modified - name: Modified3458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -125929,7 +125929,7 @@ stage: Modified - name: Modified3459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125937,7 +125937,7 @@ stage: Modified - name: Modified3460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -125947,7 +125947,7 @@ stage: Modified - name: Modified3461 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125955,7 +125955,7 @@ stage: Modified - name: Modified3462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125964,7 +125964,7 @@ stage: Modified - name: Modified3463 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769997,"checksum":"c315ecc27f51a2c91d1f6d7ed626bde55581855f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125972,7 +125972,7 @@ stage: Modified - name: Modified3464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -125981,7 +125981,7 @@ stage: Modified - name: Modified3465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -125989,7 +125989,7 @@ stage: Modified - name: Modified3466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg696\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -125999,7 +125999,7 @@ stage: Modified - name: Modified3467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -126007,7 +126007,7 @@ stage: Modified - name: Modified3468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg697\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -126017,7 +126017,7 @@ stage: Modified - name: Modified3469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -126025,7 +126025,7 @@ stage: Modified - name: Modified3470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg698\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126034,7 +126034,7 @@ stage: Modified - name: Modified3471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -126042,7 +126042,7 @@ stage: Modified - name: Modified3472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg699\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126051,7 +126051,7 @@ stage: Modified - name: Modified3473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -126059,7 +126059,7 @@ stage: Modified - name: Modified3474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg700\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -126069,7 +126069,7 @@ stage: Modified - name: Modified3475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -126077,7 +126077,7 @@ stage: Modified - name: Modified3476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg701\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -126087,7 +126087,7 @@ stage: Modified - name: Modified3477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -126095,7 +126095,7 @@ stage: Modified - name: Modified3478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg702\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126104,7 +126104,7 @@ stage: Modified - name: Modified3479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key", "arch": "[x64]", "timestamp": 1606816880, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -126112,7 +126112,7 @@ stage: Modified - name: Modified3480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg703\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126121,7 +126121,7 @@ stage: Modified - name: Modified3481 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126143,7 +126143,7 @@ stage: Modified - name: Modified3482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -126153,7 +126153,7 @@ stage: Modified - name: Modified3483 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126175,7 +126175,7 @@ stage: Modified - name: Modified3484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -126185,7 +126185,7 @@ stage: Modified - name: Modified3485 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126207,7 +126207,7 @@ stage: Modified - name: Modified3486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126216,7 +126216,7 @@ stage: Modified - name: Modified3487 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126238,7 +126238,7 @@ stage: Modified - name: Modified3488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126247,7 +126247,7 @@ stage: Modified - name: Modified3489 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126269,7 +126269,7 @@ stage: Modified - name: Modified3490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -126279,7 +126279,7 @@ stage: Modified - name: Modified3491 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126301,7 +126301,7 @@ stage: Modified - name: Modified3492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -126311,7 +126311,7 @@ stage: Modified - name: Modified3493 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126333,7 +126333,7 @@ stage: Modified - name: Modified3494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126342,7 +126342,7 @@ stage: Modified - name: Modified3495 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126364,7 +126364,7 @@ stage: Modified - name: Modified3496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126373,7 +126373,7 @@ stage: Modified - name: Modified3497 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg712\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816880,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126395,7 +126395,7 @@ stage: Modified - name: Modified3498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg712\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816880,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg712\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816880, "attributes": @@ -126405,7 +126405,7 @@ stage: Modified - name: Modified3499 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg713\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126427,7 +126427,7 @@ stage: Modified - name: Modified3500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg713\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg713\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126437,7 +126437,7 @@ stage: Modified - name: Modified3501 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg714\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126459,7 +126459,7 @@ stage: Modified - name: Modified3502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg714\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg714\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126468,7 +126468,7 @@ stage: Modified - name: Modified3503 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg715\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126490,7 +126490,7 @@ stage: Modified - name: Modified3504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg715\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg715\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126499,7 +126499,7 @@ stage: Modified - name: Modified3505 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg716\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126521,7 +126521,7 @@ stage: Modified - name: Modified3506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg716\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg716\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126531,7 +126531,7 @@ stage: Modified - name: Modified3507 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg717\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126553,7 +126553,7 @@ stage: Modified - name: Modified3508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg717\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg717\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126563,7 +126563,7 @@ stage: Modified - name: Modified3509 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg718\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126585,7 +126585,7 @@ stage: Modified - name: Modified3510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg718\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg718\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126594,7 +126594,7 @@ stage: Modified - name: Modified3511 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg719\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126616,7 +126616,7 @@ stage: Modified - name: Modified3512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg719\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg719\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126625,7 +126625,7 @@ stage: Modified - name: Modified3513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key", "arch": "[x64]", "timestamp": 1606816881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -126633,7 +126633,7 @@ stage: Modified - name: Modified3514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126643,7 +126643,7 @@ stage: Modified - name: Modified3515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key", "arch": "[x64]", "timestamp": 1606816881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -126651,7 +126651,7 @@ stage: Modified - name: Modified3516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126661,7 +126661,7 @@ stage: Modified - name: Modified3517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key", "arch": "[x64]", "timestamp": 1606816881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -126669,7 +126669,7 @@ stage: Modified - name: Modified3518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126678,7 +126678,7 @@ stage: Modified - name: Modified3519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key", "arch": "[x64]", "timestamp": 1606816881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -126686,7 +126686,7 @@ stage: Modified - name: Modified3520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126695,7 +126695,7 @@ stage: Modified - name: Modified3521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key", "arch": "[x64]", "timestamp": 1606816881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -126703,7 +126703,7 @@ stage: Modified - name: Modified3522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126713,7 +126713,7 @@ stage: Modified - name: Modified3523 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key", "arch": "[x64]", "timestamp": 1606816881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -126721,7 +126721,7 @@ stage: Modified - name: Modified3524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126731,7 +126731,7 @@ stage: Modified - name: Modified3525 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key", "arch": "[x64]", "timestamp": 1606816881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -126739,7 +126739,7 @@ stage: Modified - name: Modified3526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126748,7 +126748,7 @@ stage: Modified - name: Modified3527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769997,"checksum":"8ed60eebf6c0d047360c842b8cdeae48b0bf88d9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key", "arch": "[x64]", "timestamp": 1606816881, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -126756,7 +126756,7 @@ stage: Modified - name: Modified3528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126765,7 +126765,7 @@ stage: Modified - name: Modified3529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg728\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg728\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126775,7 +126775,7 @@ stage: Modified - name: Modified3530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg729\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg729\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126785,7 +126785,7 @@ stage: Modified - name: Modified3531 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg730\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg730\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126794,7 +126794,7 @@ stage: Modified - name: Modified3532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg731\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg731\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126803,7 +126803,7 @@ stage: Modified - name: Modified3533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg732\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg732\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126813,7 +126813,7 @@ stage: Modified - name: Modified3534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg733\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg733\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126823,7 +126823,7 @@ stage: Modified - name: Modified3535 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg734\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg734\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126832,7 +126832,7 @@ stage: Modified - name: Modified3536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg735\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg735\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126841,7 +126841,7 @@ stage: Modified - name: Modified3537 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126862,7 +126862,7 @@ stage: Modified - name: Modified3538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126872,7 +126872,7 @@ stage: Modified - name: Modified3539 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126893,7 +126893,7 @@ stage: Modified - name: Modified3540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126903,7 +126903,7 @@ stage: Modified - name: Modified3541 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126924,7 +126924,7 @@ stage: Modified - name: Modified3542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126933,7 +126933,7 @@ stage: Modified - name: Modified3543 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126954,7 +126954,7 @@ stage: Modified - name: Modified3544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -126963,7 +126963,7 @@ stage: Modified - name: Modified3545 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -126984,7 +126984,7 @@ stage: Modified - name: Modified3546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -126994,7 +126994,7 @@ stage: Modified - name: Modified3547 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127015,7 +127015,7 @@ stage: Modified - name: Modified3548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -127025,7 +127025,7 @@ stage: Modified - name: Modified3549 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127046,7 +127046,7 @@ stage: Modified - name: Modified3550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127055,7 +127055,7 @@ stage: Modified - name: Modified3551 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127076,7 +127076,7 @@ stage: Modified - name: Modified3552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127085,7 +127085,7 @@ stage: Modified - name: Modified3553 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg744\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127106,7 +127106,7 @@ stage: Modified - name: Modified3554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg744\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg744\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -127116,7 +127116,7 @@ stage: Modified - name: Modified3555 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg745\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127137,7 +127137,7 @@ stage: Modified - name: Modified3556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg745\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg745\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -127147,7 +127147,7 @@ stage: Modified - name: Modified3557 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg746\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127168,7 +127168,7 @@ stage: Modified - name: Modified3558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg746\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg746\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127177,7 +127177,7 @@ stage: Modified - name: Modified3559 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg747\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127198,7 +127198,7 @@ stage: Modified - name: Modified3560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg747\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg747\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127207,7 +127207,7 @@ stage: Modified - name: Modified3561 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg748\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127228,7 +127228,7 @@ stage: Modified - name: Modified3562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg748\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg748\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -127238,7 +127238,7 @@ stage: Modified - name: Modified3563 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg749\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816881,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127259,7 +127259,7 @@ stage: Modified - name: Modified3564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg749\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816881,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg749\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816881, "attributes": @@ -127269,7 +127269,7 @@ stage: Modified - name: Modified3565 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg750\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127290,7 +127290,7 @@ stage: Modified - name: Modified3566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg750\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg750\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127299,7 +127299,7 @@ stage: Modified - name: Modified3567 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg751\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127320,7 +127320,7 @@ stage: Modified - name: Modified3568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg751\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg751\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127329,14 +127329,14 @@ stage: Modified - name: Modified3569 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key", "arch": "[x64]", "timestamp": 1606816882, "attributes": {"type": "registry_key", "mtime": 1606769998, "checksum": "59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"}}' stage: Modified - name: Modified3570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127346,14 +127346,14 @@ stage: Modified - name: Modified3571 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key", "arch": "[x64]", "timestamp": 1606816882, "attributes": {"type": "registry_key", "mtime": 1606769998, "checksum": "59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"}}' stage: Modified - name: Modified3572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127363,14 +127363,14 @@ stage: Modified - name: Modified3573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key", "arch": "[x64]", "timestamp": 1606816882, "attributes": {"type": "registry_key", "mtime": 1606769998, "checksum": "59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"}}' stage: Modified - name: Modified3574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127379,14 +127379,14 @@ stage: Modified - name: Modified3575 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key", "arch": "[x64]", "timestamp": 1606816882, "attributes": {"type": "registry_key", "mtime": 1606769998, "checksum": "59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"}}' stage: Modified - name: Modified3576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127395,14 +127395,14 @@ stage: Modified - name: Modified3577 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key", "arch": "[x64]", "timestamp": 1606816882, "attributes": {"type": "registry_key", "mtime": 1606769998, "checksum": "59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"}}' stage: Modified - name: Modified3578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127412,14 +127412,14 @@ stage: Modified - name: Modified3579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key", "arch": "[x64]", "timestamp": 1606816882, "attributes": {"type": "registry_key", "mtime": 1606769998, "checksum": "59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"}}' stage: Modified - name: Modified3580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127429,14 +127429,14 @@ stage: Modified - name: Modified3581 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key", "arch": "[x64]", "timestamp": 1606816882, "attributes": {"type": "registry_key", "mtime": 1606769998, "checksum": "59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"}}' stage: Modified - name: Modified3582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127445,14 +127445,14 @@ stage: Modified - name: Modified3583 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","mtime":1606769998,"checksum":"59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key", "arch": "[x64]", "timestamp": 1606816882, "attributes": {"type": "registry_key", "mtime": 1606769998, "checksum": "59ccbf6ad5189c44d218545dd2b07e3ebb92f5f0"}}' stage: Modified - name: Modified3584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127461,7 +127461,7 @@ stage: Modified - name: Modified3585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg760\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg760\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127471,7 +127471,7 @@ stage: Modified - name: Modified3586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg761\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg761\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127481,7 +127481,7 @@ stage: Modified - name: Modified3587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg762\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg762\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127490,7 +127490,7 @@ stage: Modified - name: Modified3588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg763\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg763\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127499,7 +127499,7 @@ stage: Modified - name: Modified3589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg764\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg764\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127509,7 +127509,7 @@ stage: Modified - name: Modified3590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg765\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg765\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127519,7 +127519,7 @@ stage: Modified - name: Modified3591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg766\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg766\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127528,7 +127528,7 @@ stage: Modified - name: Modified3592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg767\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg767\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127537,7 +127537,7 @@ stage: Modified - name: Modified3593 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127560,7 +127560,7 @@ stage: Modified - name: Modified3594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127569,7 +127569,7 @@ stage: Modified - name: Modified3595 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127592,7 +127592,7 @@ stage: Modified - name: Modified3596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127601,7 +127601,7 @@ stage: Modified - name: Modified3597 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127624,7 +127624,7 @@ stage: Modified - name: Modified3598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127632,7 +127632,7 @@ stage: Modified - name: Modified3599 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127655,7 +127655,7 @@ stage: Modified - name: Modified3600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127663,7 +127663,7 @@ stage: Modified - name: Modified3601 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127686,7 +127686,7 @@ stage: Modified - name: Modified3602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127695,7 +127695,7 @@ stage: Modified - name: Modified3603 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127718,7 +127718,7 @@ stage: Modified - name: Modified3604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127727,7 +127727,7 @@ stage: Modified - name: Modified3605 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127750,7 +127750,7 @@ stage: Modified - name: Modified3606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127758,7 +127758,7 @@ stage: Modified - name: Modified3607 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127781,7 +127781,7 @@ stage: Modified - name: Modified3608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127789,7 +127789,7 @@ stage: Modified - name: Modified3609 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg776\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127812,7 +127812,7 @@ stage: Modified - name: Modified3610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg776\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg776\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127821,7 +127821,7 @@ stage: Modified - name: Modified3611 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg777\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127844,7 +127844,7 @@ stage: Modified - name: Modified3612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg777\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg777\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127853,7 +127853,7 @@ stage: Modified - name: Modified3613 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg778\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127876,7 +127876,7 @@ stage: Modified - name: Modified3614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg778\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg778\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127884,7 +127884,7 @@ stage: Modified - name: Modified3615 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg779\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127907,7 +127907,7 @@ stage: Modified - name: Modified3616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg779\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg779\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -127915,7 +127915,7 @@ stage: Modified - name: Modified3617 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg780\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127938,7 +127938,7 @@ stage: Modified - name: Modified3618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg780\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg780\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127947,7 +127947,7 @@ stage: Modified - name: Modified3619 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg781\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -127970,7 +127970,7 @@ stage: Modified - name: Modified3620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg781\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg781\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -127979,7 +127979,7 @@ stage: Modified - name: Modified3621 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg782\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128002,7 +128002,7 @@ stage: Modified - name: Modified3622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg782\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg782\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128010,7 +128010,7 @@ stage: Modified - name: Modified3623 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg783\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128033,7 +128033,7 @@ stage: Modified - name: Modified3624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg783\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg783\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128041,7 +128041,7 @@ stage: Modified - name: Modified3625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key", "arch": "[x64]", "timestamp": 1606816882, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128050,7 +128050,7 @@ stage: Modified - name: Modified3626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -128059,7 +128059,7 @@ stage: Modified - name: Modified3627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816882,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key", "arch": "[x64]", "timestamp": 1606816882, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128068,7 +128068,7 @@ stage: Modified - name: Modified3628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816882,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816882, "attributes": @@ -128077,7 +128077,7 @@ stage: Modified - name: Modified3629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128086,7 +128086,7 @@ stage: Modified - name: Modified3630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128094,7 +128094,7 @@ stage: Modified - name: Modified3631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128103,7 +128103,7 @@ stage: Modified - name: Modified3632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128111,7 +128111,7 @@ stage: Modified - name: Modified3633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128120,7 +128120,7 @@ stage: Modified - name: Modified3634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128129,7 +128129,7 @@ stage: Modified - name: Modified3635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128138,7 +128138,7 @@ stage: Modified - name: Modified3636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128147,7 +128147,7 @@ stage: Modified - name: Modified3637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128156,7 +128156,7 @@ stage: Modified - name: Modified3638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128164,7 +128164,7 @@ stage: Modified - name: Modified3639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769998,"checksum":"70d0aeaab535311087f4e2cc49463cdd316b98a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128173,7 +128173,7 @@ stage: Modified - name: Modified3640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128181,7 +128181,7 @@ stage: Modified - name: Modified3641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128190,7 +128190,7 @@ stage: Modified - name: Modified3642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg792\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128199,7 +128199,7 @@ stage: Modified - name: Modified3643 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128208,7 +128208,7 @@ stage: Modified - name: Modified3644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg793\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128217,7 +128217,7 @@ stage: Modified - name: Modified3645 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128226,7 +128226,7 @@ stage: Modified - name: Modified3646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg794\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128234,7 +128234,7 @@ stage: Modified - name: Modified3647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128243,7 +128243,7 @@ stage: Modified - name: Modified3648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg795\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128251,7 +128251,7 @@ stage: Modified - name: Modified3649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128260,7 +128260,7 @@ stage: Modified - name: Modified3650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg796\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128269,7 +128269,7 @@ stage: Modified - name: Modified3651 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128278,7 +128278,7 @@ stage: Modified - name: Modified3652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg797\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128287,7 +128287,7 @@ stage: Modified - name: Modified3653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128296,7 +128296,7 @@ stage: Modified - name: Modified3654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg798\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128304,7 +128304,7 @@ stage: Modified - name: Modified3655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128313,7 +128313,7 @@ stage: Modified - name: Modified3656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg799\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128321,7 +128321,7 @@ stage: Modified - name: Modified3657 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128343,7 +128343,7 @@ stage: Modified - name: Modified3658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128352,7 +128352,7 @@ stage: Modified - name: Modified3659 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128374,7 +128374,7 @@ stage: Modified - name: Modified3660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128383,7 +128383,7 @@ stage: Modified - name: Modified3661 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128405,7 +128405,7 @@ stage: Modified - name: Modified3662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128413,7 +128413,7 @@ stage: Modified - name: Modified3663 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128435,7 +128435,7 @@ stage: Modified - name: Modified3664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128443,7 +128443,7 @@ stage: Modified - name: Modified3665 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128465,7 +128465,7 @@ stage: Modified - name: Modified3666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128474,7 +128474,7 @@ stage: Modified - name: Modified3667 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128496,7 +128496,7 @@ stage: Modified - name: Modified3668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128505,7 +128505,7 @@ stage: Modified - name: Modified3669 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128527,7 +128527,7 @@ stage: Modified - name: Modified3670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128535,7 +128535,7 @@ stage: Modified - name: Modified3671 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128557,7 +128557,7 @@ stage: Modified - name: Modified3672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128565,7 +128565,7 @@ stage: Modified - name: Modified3673 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg808\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128587,7 +128587,7 @@ stage: Modified - name: Modified3674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg808\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg808\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128596,7 +128596,7 @@ stage: Modified - name: Modified3675 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg809\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128618,7 +128618,7 @@ stage: Modified - name: Modified3676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg809\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg809\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128627,7 +128627,7 @@ stage: Modified - name: Modified3677 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg810\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128649,7 +128649,7 @@ stage: Modified - name: Modified3678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg810\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg810\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128657,7 +128657,7 @@ stage: Modified - name: Modified3679 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg811\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128679,7 +128679,7 @@ stage: Modified - name: Modified3680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg811\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg811\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128687,7 +128687,7 @@ stage: Modified - name: Modified3681 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg812\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128709,7 +128709,7 @@ stage: Modified - name: Modified3682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg812\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg812\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128718,7 +128718,7 @@ stage: Modified - name: Modified3683 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg813\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128740,7 +128740,7 @@ stage: Modified - name: Modified3684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg813\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg813\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128749,7 +128749,7 @@ stage: Modified - name: Modified3685 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg814\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128771,7 +128771,7 @@ stage: Modified - name: Modified3686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg814\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg814\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128779,7 +128779,7 @@ stage: Modified - name: Modified3687 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg815\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -128801,7 +128801,7 @@ stage: Modified - name: Modified3688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg815\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg815\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128809,7 +128809,7 @@ stage: Modified - name: Modified3689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128817,7 +128817,7 @@ stage: Modified - name: Modified3690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128826,7 +128826,7 @@ stage: Modified - name: Modified3691 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128834,7 +128834,7 @@ stage: Modified - name: Modified3692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128843,7 +128843,7 @@ stage: Modified - name: Modified3693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128851,7 +128851,7 @@ stage: Modified - name: Modified3694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128859,7 +128859,7 @@ stage: Modified - name: Modified3695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128867,7 +128867,7 @@ stage: Modified - name: Modified3696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128875,7 +128875,7 @@ stage: Modified - name: Modified3697 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128883,7 +128883,7 @@ stage: Modified - name: Modified3698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128892,7 +128892,7 @@ stage: Modified - name: Modified3699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128900,7 +128900,7 @@ stage: Modified - name: Modified3700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128909,7 +128909,7 @@ stage: Modified - name: Modified3701 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128917,7 +128917,7 @@ stage: Modified - name: Modified3702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128925,7 +128925,7 @@ stage: Modified - name: Modified3703 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769999,"checksum":"1d0e87c9c31f411f2f9338d0dfb84b1656031b5c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128933,7 +128933,7 @@ stage: Modified - name: Modified3704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128941,7 +128941,7 @@ stage: Modified - name: Modified3705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816883,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key", "arch": "[x64]", "timestamp": 1606816883, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128949,7 +128949,7 @@ stage: Modified - name: Modified3706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816883,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg824\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816883, "attributes": @@ -128958,7 +128958,7 @@ stage: Modified - name: Modified3707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128966,7 +128966,7 @@ stage: Modified - name: Modified3708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg825\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -128975,7 +128975,7 @@ stage: Modified - name: Modified3709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128983,7 +128983,7 @@ stage: Modified - name: Modified3710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg826\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -128991,7 +128991,7 @@ stage: Modified - name: Modified3711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -128999,7 +128999,7 @@ stage: Modified - name: Modified3712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg827\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129007,7 +129007,7 @@ stage: Modified - name: Modified3713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -129015,7 +129015,7 @@ stage: Modified - name: Modified3714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg828\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129024,7 +129024,7 @@ stage: Modified - name: Modified3715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -129032,7 +129032,7 @@ stage: Modified - name: Modified3716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg829\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129041,7 +129041,7 @@ stage: Modified - name: Modified3717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -129049,7 +129049,7 @@ stage: Modified - name: Modified3718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg830\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129057,7 +129057,7 @@ stage: Modified - name: Modified3719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -129065,7 +129065,7 @@ stage: Modified - name: Modified3720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg831\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129073,7 +129073,7 @@ stage: Modified - name: Modified3721 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129095,7 +129095,7 @@ stage: Modified - name: Modified3722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129104,7 +129104,7 @@ stage: Modified - name: Modified3723 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129126,7 +129126,7 @@ stage: Modified - name: Modified3724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129135,7 +129135,7 @@ stage: Modified - name: Modified3725 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129157,7 +129157,7 @@ stage: Modified - name: Modified3726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129165,7 +129165,7 @@ stage: Modified - name: Modified3727 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129187,7 +129187,7 @@ stage: Modified - name: Modified3728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129195,7 +129195,7 @@ stage: Modified - name: Modified3729 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129217,7 +129217,7 @@ stage: Modified - name: Modified3730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129226,7 +129226,7 @@ stage: Modified - name: Modified3731 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129248,7 +129248,7 @@ stage: Modified - name: Modified3732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129257,7 +129257,7 @@ stage: Modified - name: Modified3733 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129279,7 +129279,7 @@ stage: Modified - name: Modified3734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129287,7 +129287,7 @@ stage: Modified - name: Modified3735 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129309,7 +129309,7 @@ stage: Modified - name: Modified3736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129317,7 +129317,7 @@ stage: Modified - name: Modified3737 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg840\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129339,7 +129339,7 @@ stage: Modified - name: Modified3738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg840\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg840\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129348,7 +129348,7 @@ stage: Modified - name: Modified3739 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg841\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129370,7 +129370,7 @@ stage: Modified - name: Modified3740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg841\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg841\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129379,7 +129379,7 @@ stage: Modified - name: Modified3741 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg842\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129401,7 +129401,7 @@ stage: Modified - name: Modified3742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg842\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg842\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129409,7 +129409,7 @@ stage: Modified - name: Modified3743 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg843\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129431,7 +129431,7 @@ stage: Modified - name: Modified3744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg843\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg843\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129439,7 +129439,7 @@ stage: Modified - name: Modified3745 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg844\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129461,7 +129461,7 @@ stage: Modified - name: Modified3746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg844\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg844\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129470,7 +129470,7 @@ stage: Modified - name: Modified3747 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg845\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129492,7 +129492,7 @@ stage: Modified - name: Modified3748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg845\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg845\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129501,7 +129501,7 @@ stage: Modified - name: Modified3749 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg846\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129523,7 +129523,7 @@ stage: Modified - name: Modified3750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg846\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg846\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129531,7 +129531,7 @@ stage: Modified - name: Modified3751 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg847\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129553,7 +129553,7 @@ stage: Modified - name: Modified3752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg847\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg847\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129561,7 +129561,7 @@ stage: Modified - name: Modified3753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -129569,7 +129569,7 @@ stage: Modified - name: Modified3754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129578,7 +129578,7 @@ stage: Modified - name: Modified3755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -129586,7 +129586,7 @@ stage: Modified - name: Modified3756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129595,7 +129595,7 @@ stage: Modified - name: Modified3757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -129603,7 +129603,7 @@ stage: Modified - name: Modified3758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129611,7 +129611,7 @@ stage: Modified - name: Modified3759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -129619,7 +129619,7 @@ stage: Modified - name: Modified3760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129627,7 +129627,7 @@ stage: Modified - name: Modified3761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -129635,7 +129635,7 @@ stage: Modified - name: Modified3762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129644,7 +129644,7 @@ stage: Modified - name: Modified3763 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -129652,7 +129652,7 @@ stage: Modified - name: Modified3764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129661,7 +129661,7 @@ stage: Modified - name: Modified3765 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -129669,7 +129669,7 @@ stage: Modified - name: Modified3766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129677,7 +129677,7 @@ stage: Modified - name: Modified3767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816884,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769999,"checksum":"8e85f0e137f8f889e12e7d835038a3da9c29caba"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key", "arch": "[x64]", "timestamp": 1606816884, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -129685,7 +129685,7 @@ stage: Modified - name: Modified3768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129693,7 +129693,7 @@ stage: Modified - name: Modified3769 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg856\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg856\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129702,7 +129702,7 @@ stage: Modified - name: Modified3770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg857\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg857\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129711,7 +129711,7 @@ stage: Modified - name: Modified3771 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg858\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg858\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129719,7 +129719,7 @@ stage: Modified - name: Modified3772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg859\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg859\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129727,7 +129727,7 @@ stage: Modified - name: Modified3773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg860\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg860\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129736,7 +129736,7 @@ stage: Modified - name: Modified3774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg861\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816884,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg861\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816884, "attributes": @@ -129745,7 +129745,7 @@ stage: Modified - name: Modified3775 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg862\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg862\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129753,7 +129753,7 @@ stage: Modified - name: Modified3776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg863\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg863\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129761,7 +129761,7 @@ stage: Modified - name: Modified3777 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129782,7 +129782,7 @@ stage: Modified - name: Modified3778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -129791,7 +129791,7 @@ stage: Modified - name: Modified3779 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129812,7 +129812,7 @@ stage: Modified - name: Modified3780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -129821,7 +129821,7 @@ stage: Modified - name: Modified3781 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129842,7 +129842,7 @@ stage: Modified - name: Modified3782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129850,7 +129850,7 @@ stage: Modified - name: Modified3783 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129871,7 +129871,7 @@ stage: Modified - name: Modified3784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129879,7 +129879,7 @@ stage: Modified - name: Modified3785 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129900,7 +129900,7 @@ stage: Modified - name: Modified3786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -129909,7 +129909,7 @@ stage: Modified - name: Modified3787 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129930,7 +129930,7 @@ stage: Modified - name: Modified3788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -129939,7 +129939,7 @@ stage: Modified - name: Modified3789 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129960,7 +129960,7 @@ stage: Modified - name: Modified3790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129968,7 +129968,7 @@ stage: Modified - name: Modified3791 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -129989,7 +129989,7 @@ stage: Modified - name: Modified3792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -129997,7 +129997,7 @@ stage: Modified - name: Modified3793 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg872\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130018,7 +130018,7 @@ stage: Modified - name: Modified3794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg872\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg872\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130027,7 +130027,7 @@ stage: Modified - name: Modified3795 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg873\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130048,7 +130048,7 @@ stage: Modified - name: Modified3796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg873\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg873\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130057,7 +130057,7 @@ stage: Modified - name: Modified3797 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg874\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130078,7 +130078,7 @@ stage: Modified - name: Modified3798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg874\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg874\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130086,7 +130086,7 @@ stage: Modified - name: Modified3799 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg875\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130107,7 +130107,7 @@ stage: Modified - name: Modified3800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg875\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg875\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130115,7 +130115,7 @@ stage: Modified - name: Modified3801 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg876\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130136,7 +130136,7 @@ stage: Modified - name: Modified3802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg876\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg876\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130145,7 +130145,7 @@ stage: Modified - name: Modified3803 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg877\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130166,7 +130166,7 @@ stage: Modified - name: Modified3804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg877\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg877\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130175,7 +130175,7 @@ stage: Modified - name: Modified3805 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg878\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130196,7 +130196,7 @@ stage: Modified - name: Modified3806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg878\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg878\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130204,7 +130204,7 @@ stage: Modified - name: Modified3807 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg879\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130225,7 +130225,7 @@ stage: Modified - name: Modified3808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg879\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg879\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130233,14 +130233,14 @@ stage: Modified - name: Modified3809 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key", "arch": "[x64]", "timestamp": 1606816885, "attributes": {"type": "registry_key", "mtime": 1606770000, "checksum": "d76c8eebbd2ded77e4870eb6405fe0d715277c23"}}' stage: Modified - name: Modified3810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130249,14 +130249,14 @@ stage: Modified - name: Modified3811 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key", "arch": "[x64]", "timestamp": 1606816885, "attributes": {"type": "registry_key", "mtime": 1606770000, "checksum": "d76c8eebbd2ded77e4870eb6405fe0d715277c23"}}' stage: Modified - name: Modified3812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130265,14 +130265,14 @@ stage: Modified - name: Modified3813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key", "arch": "[x64]", "timestamp": 1606816885, "attributes": {"type": "registry_key", "mtime": 1606770000, "checksum": "d76c8eebbd2ded77e4870eb6405fe0d715277c23"}}' stage: Modified - name: Modified3814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130280,14 +130280,14 @@ stage: Modified - name: Modified3815 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key", "arch": "[x64]", "timestamp": 1606816885, "attributes": {"type": "registry_key", "mtime": 1606770000, "checksum": "d76c8eebbd2ded77e4870eb6405fe0d715277c23"}}' stage: Modified - name: Modified3816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130295,14 +130295,14 @@ stage: Modified - name: Modified3817 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key", "arch": "[x64]", "timestamp": 1606816885, "attributes": {"type": "registry_key", "mtime": 1606770000, "checksum": "d76c8eebbd2ded77e4870eb6405fe0d715277c23"}}' stage: Modified - name: Modified3818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130311,14 +130311,14 @@ stage: Modified - name: Modified3819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key", "arch": "[x64]", "timestamp": 1606816885, "attributes": {"type": "registry_key", "mtime": 1606770000, "checksum": "d76c8eebbd2ded77e4870eb6405fe0d715277c23"}}' stage: Modified - name: Modified3820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130327,14 +130327,14 @@ stage: Modified - name: Modified3821 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key", "arch": "[x64]", "timestamp": 1606816885, "attributes": {"type": "registry_key", "mtime": 1606770000, "checksum": "d76c8eebbd2ded77e4870eb6405fe0d715277c23"}}' stage: Modified - name: Modified3822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130342,14 +130342,14 @@ stage: Modified - name: Modified3823 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","mtime":1606770000,"checksum":"d76c8eebbd2ded77e4870eb6405fe0d715277c23"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key", "arch": "[x64]", "timestamp": 1606816885, "attributes": {"type": "registry_key", "mtime": 1606770000, "checksum": "d76c8eebbd2ded77e4870eb6405fe0d715277c23"}}' stage: Modified - name: Modified3824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130357,7 +130357,7 @@ stage: Modified - name: Modified3825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg888\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg888\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130366,7 +130366,7 @@ stage: Modified - name: Modified3826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg889\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg889\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130375,7 +130375,7 @@ stage: Modified - name: Modified3827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg890\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg890\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130383,7 +130383,7 @@ stage: Modified - name: Modified3828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg891\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg891\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130391,7 +130391,7 @@ stage: Modified - name: Modified3829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg892\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg892\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130400,7 +130400,7 @@ stage: Modified - name: Modified3830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg893\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg893\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130409,7 +130409,7 @@ stage: Modified - name: Modified3831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg894\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg894\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130417,7 +130417,7 @@ stage: Modified - name: Modified3832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg895\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg895\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130425,7 +130425,7 @@ stage: Modified - name: Modified3833 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130448,7 +130448,7 @@ stage: Modified - name: Modified3834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130457,7 +130457,7 @@ stage: Modified - name: Modified3835 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130480,7 +130480,7 @@ stage: Modified - name: Modified3836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130489,7 +130489,7 @@ stage: Modified - name: Modified3837 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130512,7 +130512,7 @@ stage: Modified - name: Modified3838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130520,7 +130520,7 @@ stage: Modified - name: Modified3839 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130543,7 +130543,7 @@ stage: Modified - name: Modified3840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130551,7 +130551,7 @@ stage: Modified - name: Modified3841 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816885,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130574,7 +130574,7 @@ stage: Modified - name: Modified3842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816885,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816885, "attributes": @@ -130583,7 +130583,7 @@ stage: Modified - name: Modified3843 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130606,7 +130606,7 @@ stage: Modified - name: Modified3844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -130615,7 +130615,7 @@ stage: Modified - name: Modified3845 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130638,7 +130638,7 @@ stage: Modified - name: Modified3846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130646,7 +130646,7 @@ stage: Modified - name: Modified3847 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130669,7 +130669,7 @@ stage: Modified - name: Modified3848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130677,7 +130677,7 @@ stage: Modified - name: Modified3849 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg904\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130700,7 +130700,7 @@ stage: Modified - name: Modified3850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg904\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg904\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -130709,7 +130709,7 @@ stage: Modified - name: Modified3851 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg905\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130732,7 +130732,7 @@ stage: Modified - name: Modified3852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg905\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg905\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -130741,7 +130741,7 @@ stage: Modified - name: Modified3853 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg906\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130764,7 +130764,7 @@ stage: Modified - name: Modified3854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg906\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg906\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130772,7 +130772,7 @@ stage: Modified - name: Modified3855 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg907\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130795,7 +130795,7 @@ stage: Modified - name: Modified3856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg907\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg907\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130803,7 +130803,7 @@ stage: Modified - name: Modified3857 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg908\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130826,7 +130826,7 @@ stage: Modified - name: Modified3858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg908\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg908\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -130835,7 +130835,7 @@ stage: Modified - name: Modified3859 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg909\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130858,7 +130858,7 @@ stage: Modified - name: Modified3860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg909\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg909\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -130867,7 +130867,7 @@ stage: Modified - name: Modified3861 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg910\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130890,7 +130890,7 @@ stage: Modified - name: Modified3862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg910\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg910\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130898,7 +130898,7 @@ stage: Modified - name: Modified3863 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg911\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -130921,7 +130921,7 @@ stage: Modified - name: Modified3864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg911\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg911\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130929,7 +130929,7 @@ stage: Modified - name: Modified3865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -130938,7 +130938,7 @@ stage: Modified - name: Modified3866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -130947,7 +130947,7 @@ stage: Modified - name: Modified3867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -130956,7 +130956,7 @@ stage: Modified - name: Modified3868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -130965,7 +130965,7 @@ stage: Modified - name: Modified3869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -130974,7 +130974,7 @@ stage: Modified - name: Modified3870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130982,7 +130982,7 @@ stage: Modified - name: Modified3871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -130991,7 +130991,7 @@ stage: Modified - name: Modified3872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -130999,7 +130999,7 @@ stage: Modified - name: Modified3873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131008,7 +131008,7 @@ stage: Modified - name: Modified3874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -131017,7 +131017,7 @@ stage: Modified - name: Modified3875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131026,7 +131026,7 @@ stage: Modified - name: Modified3876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -131035,7 +131035,7 @@ stage: Modified - name: Modified3877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131044,7 +131044,7 @@ stage: Modified - name: Modified3878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131052,7 +131052,7 @@ stage: Modified - name: Modified3879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770000,"checksum":"f9a98ae495a49d2cc8b016f880a47b2a6857960c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131061,7 +131061,7 @@ stage: Modified - name: Modified3880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131069,7 +131069,7 @@ stage: Modified - name: Modified3881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131078,7 +131078,7 @@ stage: Modified - name: Modified3882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg920\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -131087,7 +131087,7 @@ stage: Modified - name: Modified3883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131096,7 +131096,7 @@ stage: Modified - name: Modified3884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg921\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -131105,7 +131105,7 @@ stage: Modified - name: Modified3885 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131114,7 +131114,7 @@ stage: Modified - name: Modified3886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg922\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131122,7 +131122,7 @@ stage: Modified - name: Modified3887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131131,7 +131131,7 @@ stage: Modified - name: Modified3888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg923\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131139,7 +131139,7 @@ stage: Modified - name: Modified3889 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131148,7 +131148,7 @@ stage: Modified - name: Modified3890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg924\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -131157,7 +131157,7 @@ stage: Modified - name: Modified3891 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131166,7 +131166,7 @@ stage: Modified - name: Modified3892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg925\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -131175,7 +131175,7 @@ stage: Modified - name: Modified3893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131184,7 +131184,7 @@ stage: Modified - name: Modified3894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg926\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131192,7 +131192,7 @@ stage: Modified - name: Modified3895 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key", "arch": "[x64]", "timestamp": 1606816886, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131201,7 +131201,7 @@ stage: Modified - name: Modified3896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg927\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131209,7 +131209,7 @@ stage: Modified - name: Modified3897 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131231,7 +131231,7 @@ stage: Modified - name: Modified3898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -131240,7 +131240,7 @@ stage: Modified - name: Modified3899 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131262,7 +131262,7 @@ stage: Modified - name: Modified3900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -131271,7 +131271,7 @@ stage: Modified - name: Modified3901 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131293,7 +131293,7 @@ stage: Modified - name: Modified3902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131301,7 +131301,7 @@ stage: Modified - name: Modified3903 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131323,7 +131323,7 @@ stage: Modified - name: Modified3904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131331,7 +131331,7 @@ stage: Modified - name: Modified3905 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131353,7 +131353,7 @@ stage: Modified - name: Modified3906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -131362,7 +131362,7 @@ stage: Modified - name: Modified3907 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131384,7 +131384,7 @@ stage: Modified - name: Modified3908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -131393,7 +131393,7 @@ stage: Modified - name: Modified3909 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131415,7 +131415,7 @@ stage: Modified - name: Modified3910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131423,7 +131423,7 @@ stage: Modified - name: Modified3911 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131445,7 +131445,7 @@ stage: Modified - name: Modified3912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131453,7 +131453,7 @@ stage: Modified - name: Modified3913 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg936\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816886,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131475,7 +131475,7 @@ stage: Modified - name: Modified3914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg936\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816886,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg936\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816886, "attributes": @@ -131484,7 +131484,7 @@ stage: Modified - name: Modified3915 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg937\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131506,7 +131506,7 @@ stage: Modified - name: Modified3916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg937\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg937\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131515,7 +131515,7 @@ stage: Modified - name: Modified3917 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg938\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131537,7 +131537,7 @@ stage: Modified - name: Modified3918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg938\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg938\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131545,7 +131545,7 @@ stage: Modified - name: Modified3919 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg939\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131567,7 +131567,7 @@ stage: Modified - name: Modified3920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg939\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg939\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131575,7 +131575,7 @@ stage: Modified - name: Modified3921 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg940\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131597,7 +131597,7 @@ stage: Modified - name: Modified3922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg940\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg940\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131606,7 +131606,7 @@ stage: Modified - name: Modified3923 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg941\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131628,7 +131628,7 @@ stage: Modified - name: Modified3924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg941\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg941\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131637,7 +131637,7 @@ stage: Modified - name: Modified3925 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg942\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131659,7 +131659,7 @@ stage: Modified - name: Modified3926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg942\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg942\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131667,7 +131667,7 @@ stage: Modified - name: Modified3927 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg943\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131689,7 +131689,7 @@ stage: Modified - name: Modified3928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg943\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg943\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131697,7 +131697,7 @@ stage: Modified - name: Modified3929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770000,"checksum":"78ebd9f03e7b1889e29c6a355a60710cbcc92269"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770000,"checksum":"78ebd9f03e7b1889e29c6a355a60710cbcc92269"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131705,7 +131705,7 @@ stage: Modified - name: Modified3930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131714,7 +131714,7 @@ stage: Modified - name: Modified3931 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770000,"checksum":"78ebd9f03e7b1889e29c6a355a60710cbcc92269"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770000,"checksum":"78ebd9f03e7b1889e29c6a355a60710cbcc92269"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131722,7 +131722,7 @@ stage: Modified - name: Modified3932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131731,7 +131731,7 @@ stage: Modified - name: Modified3933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770000,"checksum":"78ebd9f03e7b1889e29c6a355a60710cbcc92269"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770000,"checksum":"78ebd9f03e7b1889e29c6a355a60710cbcc92269"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131739,7 +131739,7 @@ stage: Modified - name: Modified3934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131747,7 +131747,7 @@ stage: Modified - name: Modified3935 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770000,"checksum":"78ebd9f03e7b1889e29c6a355a60710cbcc92269"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770000,"checksum":"78ebd9f03e7b1889e29c6a355a60710cbcc92269"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131755,7 +131755,7 @@ stage: Modified - name: Modified3936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131763,7 +131763,7 @@ stage: Modified - name: Modified3937 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770000,"checksum":"78ebd9f03e7b1889e29c6a355a60710cbcc92269"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770000,"checksum":"78ebd9f03e7b1889e29c6a355a60710cbcc92269"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131771,7 +131771,7 @@ stage: Modified - name: Modified3938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131780,7 +131780,7 @@ stage: Modified - name: Modified3939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770001,"checksum":"0ef7ae44d2b3abae4ee440f57b0fd82549d7b20a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770001,"checksum":"0ef7ae44d2b3abae4ee440f57b0fd82549d7b20a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131788,7 +131788,7 @@ stage: Modified - name: Modified3940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131797,7 +131797,7 @@ stage: Modified - name: Modified3941 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770001,"checksum":"0ef7ae44d2b3abae4ee440f57b0fd82549d7b20a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770001,"checksum":"0ef7ae44d2b3abae4ee440f57b0fd82549d7b20a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131805,7 +131805,7 @@ stage: Modified - name: Modified3942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131813,7 +131813,7 @@ stage: Modified - name: Modified3943 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770001,"checksum":"0ef7ae44d2b3abae4ee440f57b0fd82549d7b20a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770001,"checksum":"0ef7ae44d2b3abae4ee440f57b0fd82549d7b20a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131821,7 +131821,7 @@ stage: Modified - name: Modified3944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131829,7 +131829,7 @@ stage: Modified - name: Modified3945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131837,7 +131837,7 @@ stage: Modified - name: Modified3946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg952\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131846,7 +131846,7 @@ stage: Modified - name: Modified3947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131854,7 +131854,7 @@ stage: Modified - name: Modified3948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg953\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131863,7 +131863,7 @@ stage: Modified - name: Modified3949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131871,7 +131871,7 @@ stage: Modified - name: Modified3950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg954\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131879,7 +131879,7 @@ stage: Modified - name: Modified3951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131887,7 +131887,7 @@ stage: Modified - name: Modified3952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg955\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131895,7 +131895,7 @@ stage: Modified - name: Modified3953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131903,7 +131903,7 @@ stage: Modified - name: Modified3954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg956\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131912,7 +131912,7 @@ stage: Modified - name: Modified3955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131920,7 +131920,7 @@ stage: Modified - name: Modified3956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg957\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131929,7 +131929,7 @@ stage: Modified - name: Modified3957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131937,7 +131937,7 @@ stage: Modified - name: Modified3958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg958\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131945,7 +131945,7 @@ stage: Modified - name: Modified3959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -131953,7 +131953,7 @@ stage: Modified - name: Modified3960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg959\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -131961,7 +131961,7 @@ stage: Modified - name: Modified3961 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -131983,7 +131983,7 @@ stage: Modified - name: Modified3962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -131992,7 +131992,7 @@ stage: Modified - name: Modified3963 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132014,7 +132014,7 @@ stage: Modified - name: Modified3964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -132023,7 +132023,7 @@ stage: Modified - name: Modified3965 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132045,7 +132045,7 @@ stage: Modified - name: Modified3966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132053,7 +132053,7 @@ stage: Modified - name: Modified3967 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132075,7 +132075,7 @@ stage: Modified - name: Modified3968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132083,7 +132083,7 @@ stage: Modified - name: Modified3969 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132105,7 +132105,7 @@ stage: Modified - name: Modified3970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -132114,7 +132114,7 @@ stage: Modified - name: Modified3971 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132136,7 +132136,7 @@ stage: Modified - name: Modified3972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -132145,7 +132145,7 @@ stage: Modified - name: Modified3973 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132167,7 +132167,7 @@ stage: Modified - name: Modified3974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132175,7 +132175,7 @@ stage: Modified - name: Modified3975 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132197,7 +132197,7 @@ stage: Modified - name: Modified3976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132205,7 +132205,7 @@ stage: Modified - name: Modified3977 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg968\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132227,7 +132227,7 @@ stage: Modified - name: Modified3978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg968\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg968\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -132236,7 +132236,7 @@ stage: Modified - name: Modified3979 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg969\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132258,7 +132258,7 @@ stage: Modified - name: Modified3980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg969\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg969\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -132267,7 +132267,7 @@ stage: Modified - name: Modified3981 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg970\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132289,7 +132289,7 @@ stage: Modified - name: Modified3982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg970\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg970\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132297,7 +132297,7 @@ stage: Modified - name: Modified3983 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg971\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132319,7 +132319,7 @@ stage: Modified - name: Modified3984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg971\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg971\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132327,7 +132327,7 @@ stage: Modified - name: Modified3985 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg972\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132349,7 +132349,7 @@ stage: Modified - name: Modified3986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg972\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg972\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -132358,7 +132358,7 @@ stage: Modified - name: Modified3987 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg973\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132380,7 +132380,7 @@ stage: Modified - name: Modified3988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg973\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg973\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -132389,7 +132389,7 @@ stage: Modified - name: Modified3989 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg974\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132411,7 +132411,7 @@ stage: Modified - name: Modified3990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg974\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg974\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132419,7 +132419,7 @@ stage: Modified - name: Modified3991 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg975\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132441,7 +132441,7 @@ stage: Modified - name: Modified3992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg975\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg975\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132449,7 +132449,7 @@ stage: Modified - name: Modified3993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816887,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key", "arch": "[x64]", "timestamp": 1606816887, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -132457,7 +132457,7 @@ stage: Modified - name: Modified3994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816887,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816887, "attributes": @@ -132466,7 +132466,7 @@ stage: Modified - name: Modified3995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -132474,7 +132474,7 @@ stage: Modified - name: Modified3996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132483,7 +132483,7 @@ stage: Modified - name: Modified3997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -132491,7 +132491,7 @@ stage: Modified - name: Modified3998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132499,7 +132499,7 @@ stage: Modified - name: Modified3999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -132507,7 +132507,7 @@ stage: Modified - name: Modified4000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132515,7 +132515,7 @@ stage: Modified - name: Modified4001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -132523,7 +132523,7 @@ stage: Modified - name: Modified4002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132532,7 +132532,7 @@ stage: Modified - name: Modified4003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -132540,7 +132540,7 @@ stage: Modified - name: Modified4004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132549,7 +132549,7 @@ stage: Modified - name: Modified4005 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -132557,7 +132557,7 @@ stage: Modified - name: Modified4006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132565,7 +132565,7 @@ stage: Modified - name: Modified4007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770001,"checksum":"a0ca703bfbfcbf591f0bd0285f65cfd6849ad91c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -132573,7 +132573,7 @@ stage: Modified - name: Modified4008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132581,7 +132581,7 @@ stage: Modified - name: Modified4009 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg984\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg984\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132590,7 +132590,7 @@ stage: Modified - name: Modified4010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg985\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg985\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132599,7 +132599,7 @@ stage: Modified - name: Modified4011 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg986\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg986\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132607,7 +132607,7 @@ stage: Modified - name: Modified4012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg987\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg987\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132615,7 +132615,7 @@ stage: Modified - name: Modified4013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg988\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg988\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132624,7 +132624,7 @@ stage: Modified - name: Modified4014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg989\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg989\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132633,7 +132633,7 @@ stage: Modified - name: Modified4015 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg990\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg990\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132641,7 +132641,7 @@ stage: Modified - name: Modified4016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg991\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg991\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132649,7 +132649,7 @@ stage: Modified - name: Modified4017 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132670,7 +132670,7 @@ stage: Modified - name: Modified4018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132679,7 +132679,7 @@ stage: Modified - name: Modified4019 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132700,7 +132700,7 @@ stage: Modified - name: Modified4020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132709,7 +132709,7 @@ stage: Modified - name: Modified4021 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132730,7 +132730,7 @@ stage: Modified - name: Modified4022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132738,7 +132738,7 @@ stage: Modified - name: Modified4023 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132759,7 +132759,7 @@ stage: Modified - name: Modified4024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132767,7 +132767,7 @@ stage: Modified - name: Modified4025 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132788,7 +132788,7 @@ stage: Modified - name: Modified4026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132797,7 +132797,7 @@ stage: Modified - name: Modified4027 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132818,7 +132818,7 @@ stage: Modified - name: Modified4028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132827,7 +132827,7 @@ stage: Modified - name: Modified4029 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132848,7 +132848,7 @@ stage: Modified - name: Modified4030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132856,7 +132856,7 @@ stage: Modified - name: Modified4031 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132877,7 +132877,7 @@ stage: Modified - name: Modified4032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132885,7 +132885,7 @@ stage: Modified - name: Modified4033 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1000\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132906,7 +132906,7 @@ stage: Modified - name: Modified4034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1000\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1000\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132915,7 +132915,7 @@ stage: Modified - name: Modified4035 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1001\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132936,7 +132936,7 @@ stage: Modified - name: Modified4036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1001\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1001\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -132945,7 +132945,7 @@ stage: Modified - name: Modified4037 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1002\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132966,7 +132966,7 @@ stage: Modified - name: Modified4038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1002\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1002\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -132974,7 +132974,7 @@ stage: Modified - name: Modified4039 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1003\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -132995,7 +132995,7 @@ stage: Modified - name: Modified4040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1003\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1003\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -133003,7 +133003,7 @@ stage: Modified - name: Modified4041 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1004\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133024,7 +133024,7 @@ stage: Modified - name: Modified4042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1004\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1004\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -133033,7 +133033,7 @@ stage: Modified - name: Modified4043 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1005\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133054,7 +133054,7 @@ stage: Modified - name: Modified4044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1005\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1005\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -133063,7 +133063,7 @@ stage: Modified - name: Modified4045 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1006\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133084,7 +133084,7 @@ stage: Modified - name: Modified4046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1006\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1006\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -133092,7 +133092,7 @@ stage: Modified - name: Modified4047 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1007\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133113,7 +133113,7 @@ stage: Modified - name: Modified4048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1007\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1007\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -133121,14 +133121,14 @@ stage: Modified - name: Modified4049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "mtime": 1606770001, "checksum": "da711d53ee2094956311eac999d843e1392f42c4"}}' stage: Modified - name: Modified4050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -133137,14 +133137,14 @@ stage: Modified - name: Modified4051 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "mtime": 1606770001, "checksum": "da711d53ee2094956311eac999d843e1392f42c4"}}' stage: Modified - name: Modified4052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -133153,14 +133153,14 @@ stage: Modified - name: Modified4053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "mtime": 1606770001, "checksum": "da711d53ee2094956311eac999d843e1392f42c4"}}' stage: Modified - name: Modified4054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -133168,14 +133168,14 @@ stage: Modified - name: Modified4055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "mtime": 1606770001, "checksum": "da711d53ee2094956311eac999d843e1392f42c4"}}' stage: Modified - name: Modified4056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -133183,14 +133183,14 @@ stage: Modified - name: Modified4057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "mtime": 1606770001, "checksum": "da711d53ee2094956311eac999d843e1392f42c4"}}' stage: Modified - name: Modified4058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -133199,14 +133199,14 @@ stage: Modified - name: Modified4059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "mtime": 1606770001, "checksum": "da711d53ee2094956311eac999d843e1392f42c4"}}' stage: Modified - name: Modified4060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -133215,14 +133215,14 @@ stage: Modified - name: Modified4061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "mtime": 1606770001, "checksum": "da711d53ee2094956311eac999d843e1392f42c4"}}' stage: Modified - name: Modified4062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -133230,14 +133230,14 @@ stage: Modified - name: Modified4063 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816888,"attributes":{"type":"registry_key","mtime":1606770001,"checksum":"da711d53ee2094956311eac999d843e1392f42c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key", "arch": "[x64]", "timestamp": 1606816888, "attributes": {"type": "registry_key", "mtime": 1606770001, "checksum": "da711d53ee2094956311eac999d843e1392f42c4"}}' stage: Modified - name: Modified4064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -133245,7 +133245,7 @@ stage: Modified - name: Modified4065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1016\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816888,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1016\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816888, "attributes": @@ -133254,7 +133254,7 @@ stage: Modified - name: Modified4066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1017\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1017\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133263,7 +133263,7 @@ stage: Modified - name: Modified4067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1018\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1018\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -133271,7 +133271,7 @@ stage: Modified - name: Modified4068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1019\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1019\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -133279,7 +133279,7 @@ stage: Modified - name: Modified4069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1020\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1020\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133288,7 +133288,7 @@ stage: Modified - name: Modified4070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1021\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1021\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133297,7 +133297,7 @@ stage: Modified - name: Modified4071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1022\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1022\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -133305,7 +133305,7 @@ stage: Modified - name: Modified4072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1023\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1023\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -133313,7 +133313,7 @@ stage: Modified - name: Modified4073 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133336,7 +133336,7 @@ stage: Modified - name: Modified4074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133346,7 +133346,7 @@ stage: Modified - name: Modified4075 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133369,7 +133369,7 @@ stage: Modified - name: Modified4076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133379,7 +133379,7 @@ stage: Modified - name: Modified4077 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133402,7 +133402,7 @@ stage: Modified - name: Modified4078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133411,7 +133411,7 @@ stage: Modified - name: Modified4079 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133434,7 +133434,7 @@ stage: Modified - name: Modified0 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133443,7 +133443,7 @@ stage: Modified - name: Modified1 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133466,7 +133466,7 @@ stage: Modified - name: Modified2 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133476,7 +133476,7 @@ stage: Modified - name: Modified3 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133499,7 +133499,7 @@ stage: Modified - name: Modified4 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133509,7 +133509,7 @@ stage: Modified - name: Modified5 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133532,7 +133532,7 @@ stage: Modified - name: Modified6 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133541,7 +133541,7 @@ stage: Modified - name: Modified7 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133564,7 +133564,7 @@ stage: Modified - name: Modified8 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133573,7 +133573,7 @@ stage: Modified - name: Modified9 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1032\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133596,7 +133596,7 @@ stage: Modified - name: Modified10 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1032\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1032\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133606,7 +133606,7 @@ stage: Modified - name: Modified11 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1033\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133629,7 +133629,7 @@ stage: Modified - name: Modified12 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1033\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1033\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133639,7 +133639,7 @@ stage: Modified - name: Modified13 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1034\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133662,7 +133662,7 @@ stage: Modified - name: Modified14 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1034\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1034\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133671,7 +133671,7 @@ stage: Modified - name: Modified15 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1035\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133694,7 +133694,7 @@ stage: Modified - name: Modified16 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1035\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1035\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133703,7 +133703,7 @@ stage: Modified - name: Modified17 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1036\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133726,7 +133726,7 @@ stage: Modified - name: Modified18 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1036\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1036\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133736,7 +133736,7 @@ stage: Modified - name: Modified19 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1037\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133759,7 +133759,7 @@ stage: Modified - name: Modified20 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1037\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1037\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133769,7 +133769,7 @@ stage: Modified - name: Modified21 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1038\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133792,7 +133792,7 @@ stage: Modified - name: Modified22 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1038\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1038\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133801,7 +133801,7 @@ stage: Modified - name: Modified23 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1039\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -133824,7 +133824,7 @@ stage: Modified - name: Modified24 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1039\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1039\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133833,7 +133833,7 @@ stage: Modified - name: Modified25 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -133842,7 +133842,7 @@ stage: Modified - name: Modified26 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133852,7 +133852,7 @@ stage: Modified - name: Modified27 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -133861,7 +133861,7 @@ stage: Modified - name: Modified28 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133871,7 +133871,7 @@ stage: Modified - name: Modified29 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -133880,7 +133880,7 @@ stage: Modified - name: Modified30 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133889,7 +133889,7 @@ stage: Modified - name: Modified31 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -133898,7 +133898,7 @@ stage: Modified - name: Modified32 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133907,7 +133907,7 @@ stage: Modified - name: Modified33 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -133916,7 +133916,7 @@ stage: Modified - name: Modified34 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133926,7 +133926,7 @@ stage: Modified - name: Modified35 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -133935,7 +133935,7 @@ stage: Modified - name: Modified36 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -133945,7 +133945,7 @@ stage: Modified - name: Modified37 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -133954,7 +133954,7 @@ stage: Modified - name: Modified38 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133963,7 +133963,7 @@ stage: Modified - name: Modified39 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770002,"checksum":"0d3a34f7438c80a682e575f8a07e1c5f5ed1f81b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -133972,7 +133972,7 @@ stage: Modified - name: Modified40 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -133981,7 +133981,7 @@ stage: Modified - name: Modified41 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -133990,7 +133990,7 @@ stage: Modified - name: Modified42 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1048\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -134000,7 +134000,7 @@ stage: Modified - name: Modified43 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134009,7 +134009,7 @@ stage: Modified - name: Modified44 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1049\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -134019,7 +134019,7 @@ stage: Modified - name: Modified45 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134028,7 +134028,7 @@ stage: Modified - name: Modified46 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1050\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134037,7 +134037,7 @@ stage: Modified - name: Modified47 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134046,7 +134046,7 @@ stage: Modified - name: Modified48 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1051\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134055,7 +134055,7 @@ stage: Modified - name: Modified49 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134064,7 +134064,7 @@ stage: Modified - name: Modified50 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1052\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -134074,7 +134074,7 @@ stage: Modified - name: Modified51 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816889,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key", "arch": "[x64]", "timestamp": 1606816889, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134083,7 +134083,7 @@ stage: Modified - name: Modified52 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816889,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1053\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816889, "attributes": @@ -134093,7 +134093,7 @@ stage: Modified - name: Modified53 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134102,7 +134102,7 @@ stage: Modified - name: Modified54 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1054\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134111,7 +134111,7 @@ stage: Modified - name: Modified55 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134120,7 +134120,7 @@ stage: Modified - name: Modified56 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1055\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134129,7 +134129,7 @@ stage: Modified - name: Modified57 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134151,7 +134151,7 @@ stage: Modified - name: Modified58 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134161,7 +134161,7 @@ stage: Modified - name: Modified59 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134183,7 +134183,7 @@ stage: Modified - name: Modified60 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134193,7 +134193,7 @@ stage: Modified - name: Modified61 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134215,7 +134215,7 @@ stage: Modified - name: Modified62 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134224,7 +134224,7 @@ stage: Modified - name: Modified63 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134246,7 +134246,7 @@ stage: Modified - name: Modified64 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134255,7 +134255,7 @@ stage: Modified - name: Modified65 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134277,7 +134277,7 @@ stage: Modified - name: Modified66 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134287,7 +134287,7 @@ stage: Modified - name: Modified67 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134309,7 +134309,7 @@ stage: Modified - name: Modified68 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134319,7 +134319,7 @@ stage: Modified - name: Modified69 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134341,7 +134341,7 @@ stage: Modified - name: Modified70 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134350,7 +134350,7 @@ stage: Modified - name: Modified71 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134372,7 +134372,7 @@ stage: Modified - name: Modified72 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134381,7 +134381,7 @@ stage: Modified - name: Modified73 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1064\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134403,7 +134403,7 @@ stage: Modified - name: Modified74 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1064\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1064\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134413,7 +134413,7 @@ stage: Modified - name: Modified75 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1065\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134435,7 +134435,7 @@ stage: Modified - name: Modified76 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1065\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1065\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134445,7 +134445,7 @@ stage: Modified - name: Modified77 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1066\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134467,7 +134467,7 @@ stage: Modified - name: Modified78 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1066\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1066\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134476,7 +134476,7 @@ stage: Modified - name: Modified79 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1067\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134498,7 +134498,7 @@ stage: Modified - name: Modified80 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1067\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1067\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134507,7 +134507,7 @@ stage: Modified - name: Modified81 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1068\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134529,7 +134529,7 @@ stage: Modified - name: Modified82 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1068\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1068\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134539,7 +134539,7 @@ stage: Modified - name: Modified83 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1069\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134561,7 +134561,7 @@ stage: Modified - name: Modified84 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1069\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1069\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134571,7 +134571,7 @@ stage: Modified - name: Modified85 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1070\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134593,7 +134593,7 @@ stage: Modified - name: Modified86 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1070\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1070\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134602,7 +134602,7 @@ stage: Modified - name: Modified87 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1071\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134624,7 +134624,7 @@ stage: Modified - name: Modified88 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1071\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1071\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134633,7 +134633,7 @@ stage: Modified - name: Modified89 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134641,7 +134641,7 @@ stage: Modified - name: Modified90 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134651,7 +134651,7 @@ stage: Modified - name: Modified91 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134659,7 +134659,7 @@ stage: Modified - name: Modified92 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134669,7 +134669,7 @@ stage: Modified - name: Modified93 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134677,7 +134677,7 @@ stage: Modified - name: Modified94 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134686,7 +134686,7 @@ stage: Modified - name: Modified95 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134694,7 +134694,7 @@ stage: Modified - name: Modified96 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134703,7 +134703,7 @@ stage: Modified - name: Modified97 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134711,7 +134711,7 @@ stage: Modified - name: Modified98 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134721,7 +134721,7 @@ stage: Modified - name: Modified99 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134729,7 +134729,7 @@ stage: Modified - name: Modified100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134739,7 +134739,7 @@ stage: Modified - name: Modified101 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134747,7 +134747,7 @@ stage: Modified - name: Modified102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134756,7 +134756,7 @@ stage: Modified - name: Modified103 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770002,"checksum":"1ef72b687055a8b68717596a8e60755a67df82a5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134764,7 +134764,7 @@ stage: Modified - name: Modified104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134773,7 +134773,7 @@ stage: Modified - name: Modified105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134781,7 +134781,7 @@ stage: Modified - name: Modified106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1080\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134791,7 +134791,7 @@ stage: Modified - name: Modified107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134799,7 +134799,7 @@ stage: Modified - name: Modified108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1081\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134809,7 +134809,7 @@ stage: Modified - name: Modified109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134817,7 +134817,7 @@ stage: Modified - name: Modified110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1082\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134826,7 +134826,7 @@ stage: Modified - name: Modified111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134834,7 +134834,7 @@ stage: Modified - name: Modified112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1083\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134843,7 +134843,7 @@ stage: Modified - name: Modified113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134851,7 +134851,7 @@ stage: Modified - name: Modified114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1084\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134861,7 +134861,7 @@ stage: Modified - name: Modified115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134869,7 +134869,7 @@ stage: Modified - name: Modified116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1085\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134879,7 +134879,7 @@ stage: Modified - name: Modified117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134887,7 +134887,7 @@ stage: Modified - name: Modified118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1086\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134896,7 +134896,7 @@ stage: Modified - name: Modified119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key", "arch": "[x64]", "timestamp": 1606816890, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -134904,7 +134904,7 @@ stage: Modified - name: Modified120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1087\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -134913,7 +134913,7 @@ stage: Modified - name: Modified121 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134935,7 +134935,7 @@ stage: Modified - name: Modified122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134945,7 +134945,7 @@ stage: Modified - name: Modified123 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816890,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134967,7 +134967,7 @@ stage: Modified - name: Modified124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816890,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816890, "attributes": @@ -134977,7 +134977,7 @@ stage: Modified - name: Modified125 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -134999,7 +134999,7 @@ stage: Modified - name: Modified126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135008,7 +135008,7 @@ stage: Modified - name: Modified127 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135030,7 +135030,7 @@ stage: Modified - name: Modified128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135039,7 +135039,7 @@ stage: Modified - name: Modified129 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135061,7 +135061,7 @@ stage: Modified - name: Modified130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135071,7 +135071,7 @@ stage: Modified - name: Modified131 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135093,7 +135093,7 @@ stage: Modified - name: Modified132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135103,7 +135103,7 @@ stage: Modified - name: Modified133 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135125,7 +135125,7 @@ stage: Modified - name: Modified134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135134,7 +135134,7 @@ stage: Modified - name: Modified135 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135156,7 +135156,7 @@ stage: Modified - name: Modified136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135165,7 +135165,7 @@ stage: Modified - name: Modified137 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1096\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135187,7 +135187,7 @@ stage: Modified - name: Modified138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1096\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1096\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135197,7 +135197,7 @@ stage: Modified - name: Modified139 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1097\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135219,7 +135219,7 @@ stage: Modified - name: Modified140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1097\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1097\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135229,7 +135229,7 @@ stage: Modified - name: Modified141 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1098\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135251,7 +135251,7 @@ stage: Modified - name: Modified142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1098\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1098\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135260,7 +135260,7 @@ stage: Modified - name: Modified143 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1099\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135282,7 +135282,7 @@ stage: Modified - name: Modified144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1099\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1099\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135291,7 +135291,7 @@ stage: Modified - name: Modified145 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1100\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135313,7 +135313,7 @@ stage: Modified - name: Modified146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1100\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1100\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135323,7 +135323,7 @@ stage: Modified - name: Modified147 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1101\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135345,7 +135345,7 @@ stage: Modified - name: Modified148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1101\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1101\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135355,7 +135355,7 @@ stage: Modified - name: Modified149 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1102\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135377,7 +135377,7 @@ stage: Modified - name: Modified150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1102\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1102\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135386,7 +135386,7 @@ stage: Modified - name: Modified151 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1103\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135408,7 +135408,7 @@ stage: Modified - name: Modified152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1103\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1103\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135417,7 +135417,7 @@ stage: Modified - name: Modified153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key", "arch": "[x64]", "timestamp": 1606816891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -135425,7 +135425,7 @@ stage: Modified - name: Modified154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135435,7 +135435,7 @@ stage: Modified - name: Modified155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key", "arch": "[x64]", "timestamp": 1606816891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -135443,7 +135443,7 @@ stage: Modified - name: Modified156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135453,7 +135453,7 @@ stage: Modified - name: Modified157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key", "arch": "[x64]", "timestamp": 1606816891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -135461,7 +135461,7 @@ stage: Modified - name: Modified158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135470,7 +135470,7 @@ stage: Modified - name: Modified159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key", "arch": "[x64]", "timestamp": 1606816891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -135478,7 +135478,7 @@ stage: Modified - name: Modified160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135487,7 +135487,7 @@ stage: Modified - name: Modified161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key", "arch": "[x64]", "timestamp": 1606816891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -135495,7 +135495,7 @@ stage: Modified - name: Modified162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135505,7 +135505,7 @@ stage: Modified - name: Modified163 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key", "arch": "[x64]", "timestamp": 1606816891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -135513,7 +135513,7 @@ stage: Modified - name: Modified164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135523,7 +135523,7 @@ stage: Modified - name: Modified165 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key", "arch": "[x64]", "timestamp": 1606816891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -135531,7 +135531,7 @@ stage: Modified - name: Modified166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135540,7 +135540,7 @@ stage: Modified - name: Modified167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770003,"checksum":"d026c2654de566d11bcc29210b3476117cca0c2b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key", "arch": "[x64]", "timestamp": 1606816891, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -135548,7 +135548,7 @@ stage: Modified - name: Modified168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135557,7 +135557,7 @@ stage: Modified - name: Modified169 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1112\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1112\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135567,7 +135567,7 @@ stage: Modified - name: Modified170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1113\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1113\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135577,7 +135577,7 @@ stage: Modified - name: Modified171 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1114\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1114\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135586,7 +135586,7 @@ stage: Modified - name: Modified172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1115\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1115\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135595,7 +135595,7 @@ stage: Modified - name: Modified173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1116\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1116\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135605,7 +135605,7 @@ stage: Modified - name: Modified174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1117\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1117\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135615,7 +135615,7 @@ stage: Modified - name: Modified175 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1118\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1118\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135624,7 +135624,7 @@ stage: Modified - name: Modified176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1119\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1119\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135633,7 +135633,7 @@ stage: Modified - name: Modified177 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135654,7 +135654,7 @@ stage: Modified - name: Modified178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135664,7 +135664,7 @@ stage: Modified - name: Modified179 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135685,7 +135685,7 @@ stage: Modified - name: Modified180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135695,7 +135695,7 @@ stage: Modified - name: Modified181 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135716,7 +135716,7 @@ stage: Modified - name: Modified182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135725,7 +135725,7 @@ stage: Modified - name: Modified183 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135746,7 +135746,7 @@ stage: Modified - name: Modified184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135755,7 +135755,7 @@ stage: Modified - name: Modified185 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135776,7 +135776,7 @@ stage: Modified - name: Modified186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135786,7 +135786,7 @@ stage: Modified - name: Modified187 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135807,7 +135807,7 @@ stage: Modified - name: Modified188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135817,7 +135817,7 @@ stage: Modified - name: Modified189 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135838,7 +135838,7 @@ stage: Modified - name: Modified190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135847,7 +135847,7 @@ stage: Modified - name: Modified191 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135868,7 +135868,7 @@ stage: Modified - name: Modified192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135877,7 +135877,7 @@ stage: Modified - name: Modified193 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1128\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816891,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135898,7 +135898,7 @@ stage: Modified - name: Modified194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1128\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816891,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1128\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816891, "attributes": @@ -135908,7 +135908,7 @@ stage: Modified - name: Modified195 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1129\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135929,7 +135929,7 @@ stage: Modified - name: Modified196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1129\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1129\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -135939,7 +135939,7 @@ stage: Modified - name: Modified197 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1130\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135960,7 +135960,7 @@ stage: Modified - name: Modified198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1130\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1130\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135969,7 +135969,7 @@ stage: Modified - name: Modified199 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1131\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -135990,7 +135990,7 @@ stage: Modified - name: Modified200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1131\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1131\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -135999,7 +135999,7 @@ stage: Modified - name: Modified201 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1132\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136020,7 +136020,7 @@ stage: Modified - name: Modified202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1132\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1132\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136030,7 +136030,7 @@ stage: Modified - name: Modified203 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1133\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136051,7 +136051,7 @@ stage: Modified - name: Modified204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1133\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1133\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136061,7 +136061,7 @@ stage: Modified - name: Modified205 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1134\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136082,7 +136082,7 @@ stage: Modified - name: Modified206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1134\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1134\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136091,7 +136091,7 @@ stage: Modified - name: Modified207 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1135\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136112,7 +136112,7 @@ stage: Modified - name: Modified208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1135\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1135\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136121,14 +136121,14 @@ stage: Modified - name: Modified209 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key", "arch": "[x64]", "timestamp": 1606816892, "attributes": {"type": "registry_key", "mtime": 1606770003, "checksum": "89e34c03473e50209242c2bb255e17bc0cf00f54"}}' stage: Modified - name: Modified210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136138,14 +136138,14 @@ stage: Modified - name: Modified211 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key", "arch": "[x64]", "timestamp": 1606816892, "attributes": {"type": "registry_key", "mtime": 1606770003, "checksum": "89e34c03473e50209242c2bb255e17bc0cf00f54"}}' stage: Modified - name: Modified212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136155,14 +136155,14 @@ stage: Modified - name: Modified213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key", "arch": "[x64]", "timestamp": 1606816892, "attributes": {"type": "registry_key", "mtime": 1606770003, "checksum": "89e34c03473e50209242c2bb255e17bc0cf00f54"}}' stage: Modified - name: Modified214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136171,14 +136171,14 @@ stage: Modified - name: Modified215 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key", "arch": "[x64]", "timestamp": 1606816892, "attributes": {"type": "registry_key", "mtime": 1606770003, "checksum": "89e34c03473e50209242c2bb255e17bc0cf00f54"}}' stage: Modified - name: Modified216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136187,14 +136187,14 @@ stage: Modified - name: Modified217 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key", "arch": "[x64]", "timestamp": 1606816892, "attributes": {"type": "registry_key", "mtime": 1606770003, "checksum": "89e34c03473e50209242c2bb255e17bc0cf00f54"}}' stage: Modified - name: Modified218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136204,14 +136204,14 @@ stage: Modified - name: Modified219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key", "arch": "[x64]", "timestamp": 1606816892, "attributes": {"type": "registry_key", "mtime": 1606770003, "checksum": "89e34c03473e50209242c2bb255e17bc0cf00f54"}}' stage: Modified - name: Modified220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136221,14 +136221,14 @@ stage: Modified - name: Modified221 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key", "arch": "[x64]", "timestamp": 1606816892, "attributes": {"type": "registry_key", "mtime": 1606770003, "checksum": "89e34c03473e50209242c2bb255e17bc0cf00f54"}}' stage: Modified - name: Modified222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136237,14 +136237,14 @@ stage: Modified - name: Modified223 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","mtime":1606770003,"checksum":"89e34c03473e50209242c2bb255e17bc0cf00f54"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key", "arch": "[x64]", "timestamp": 1606816892, "attributes": {"type": "registry_key", "mtime": 1606770003, "checksum": "89e34c03473e50209242c2bb255e17bc0cf00f54"}}' stage: Modified - name: Modified224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136253,7 +136253,7 @@ stage: Modified - name: Modified225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1144\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1144\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136263,7 +136263,7 @@ stage: Modified - name: Modified226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1145\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1145\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136273,7 +136273,7 @@ stage: Modified - name: Modified227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1146\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1146\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136282,7 +136282,7 @@ stage: Modified - name: Modified228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1147\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1147\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136291,7 +136291,7 @@ stage: Modified - name: Modified229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1148\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1148\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136301,7 +136301,7 @@ stage: Modified - name: Modified230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1149\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1149\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136311,7 +136311,7 @@ stage: Modified - name: Modified231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1150\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1150\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136320,7 +136320,7 @@ stage: Modified - name: Modified232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1151\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1151\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136329,7 +136329,7 @@ stage: Modified - name: Modified233 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136352,7 +136352,7 @@ stage: Modified - name: Modified234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136362,7 +136362,7 @@ stage: Modified - name: Modified235 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136385,7 +136385,7 @@ stage: Modified - name: Modified236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136395,7 +136395,7 @@ stage: Modified - name: Modified237 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136418,7 +136418,7 @@ stage: Modified - name: Modified238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136427,7 +136427,7 @@ stage: Modified - name: Modified239 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136450,7 +136450,7 @@ stage: Modified - name: Modified240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136459,7 +136459,7 @@ stage: Modified - name: Modified241 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136482,7 +136482,7 @@ stage: Modified - name: Modified242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136492,7 +136492,7 @@ stage: Modified - name: Modified243 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136515,7 +136515,7 @@ stage: Modified - name: Modified244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136525,7 +136525,7 @@ stage: Modified - name: Modified245 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136548,7 +136548,7 @@ stage: Modified - name: Modified246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -136557,7 +136557,7 @@ stage: Modified - name: Modified247 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136580,7 +136580,7 @@ stage: Modified - name: Modified248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -136589,7 +136589,7 @@ stage: Modified - name: Modified249 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1160\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136612,7 +136612,7 @@ stage: Modified - name: Modified250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1160\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1160\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136622,7 +136622,7 @@ stage: Modified - name: Modified251 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1161\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136645,7 +136645,7 @@ stage: Modified - name: Modified252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1161\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1161\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136655,7 +136655,7 @@ stage: Modified - name: Modified253 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1162\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136678,7 +136678,7 @@ stage: Modified - name: Modified254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1162\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1162\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136687,7 +136687,7 @@ stage: Modified - name: Modified255 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1163\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136710,7 +136710,7 @@ stage: Modified - name: Modified256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1163\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1163\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136719,7 +136719,7 @@ stage: Modified - name: Modified257 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1164\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816892,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136742,7 +136742,7 @@ stage: Modified - name: Modified258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1164\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816892,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1164\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816892, "attributes": @@ -136752,7 +136752,7 @@ stage: Modified - name: Modified259 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1165\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136775,7 +136775,7 @@ stage: Modified - name: Modified260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1165\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1165\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -136785,7 +136785,7 @@ stage: Modified - name: Modified261 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1166\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136808,7 +136808,7 @@ stage: Modified - name: Modified262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1166\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1166\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -136817,7 +136817,7 @@ stage: Modified - name: Modified263 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1167\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -136840,7 +136840,7 @@ stage: Modified - name: Modified264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1167\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1167\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -136849,7 +136849,7 @@ stage: Modified - name: Modified265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -136858,7 +136858,7 @@ stage: Modified - name: Modified266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -136868,7 +136868,7 @@ stage: Modified - name: Modified267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -136877,7 +136877,7 @@ stage: Modified - name: Modified268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -136887,7 +136887,7 @@ stage: Modified - name: Modified269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -136896,7 +136896,7 @@ stage: Modified - name: Modified270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136905,7 +136905,7 @@ stage: Modified - name: Modified271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -136914,7 +136914,7 @@ stage: Modified - name: Modified272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -136923,7 +136923,7 @@ stage: Modified - name: Modified273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -136932,7 +136932,7 @@ stage: Modified - name: Modified274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -136942,7 +136942,7 @@ stage: Modified - name: Modified275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -136951,7 +136951,7 @@ stage: Modified - name: Modified276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -136961,7 +136961,7 @@ stage: Modified - name: Modified277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -136970,7 +136970,7 @@ stage: Modified - name: Modified278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -136979,7 +136979,7 @@ stage: Modified - name: Modified279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770004,"checksum":"d12ef1826461c98c1d14bdc05a809a296d0d65ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -136988,7 +136988,7 @@ stage: Modified - name: Modified280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -136997,7 +136997,7 @@ stage: Modified - name: Modified281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137006,7 +137006,7 @@ stage: Modified - name: Modified282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1176\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137016,7 +137016,7 @@ stage: Modified - name: Modified283 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137025,7 +137025,7 @@ stage: Modified - name: Modified284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1177\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137035,7 +137035,7 @@ stage: Modified - name: Modified285 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137044,7 +137044,7 @@ stage: Modified - name: Modified286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1178\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -137053,7 +137053,7 @@ stage: Modified - name: Modified287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137062,7 +137062,7 @@ stage: Modified - name: Modified288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1179\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -137071,7 +137071,7 @@ stage: Modified - name: Modified289 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137080,7 +137080,7 @@ stage: Modified - name: Modified290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1180\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137090,7 +137090,7 @@ stage: Modified - name: Modified291 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137099,7 +137099,7 @@ stage: Modified - name: Modified292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1181\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137109,7 +137109,7 @@ stage: Modified - name: Modified293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137118,7 +137118,7 @@ stage: Modified - name: Modified294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1182\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -137127,7 +137127,7 @@ stage: Modified - name: Modified295 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137136,7 +137136,7 @@ stage: Modified - name: Modified296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1183\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -137145,7 +137145,7 @@ stage: Modified - name: Modified297 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137167,7 +137167,7 @@ stage: Modified - name: Modified298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137177,7 +137177,7 @@ stage: Modified - name: Modified299 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137199,7 +137199,7 @@ stage: Modified - name: Modified300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137209,7 +137209,7 @@ stage: Modified - name: Modified301 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137231,7 +137231,7 @@ stage: Modified - name: Modified302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -137240,7 +137240,7 @@ stage: Modified - name: Modified303 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137262,7 +137262,7 @@ stage: Modified - name: Modified304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -137271,7 +137271,7 @@ stage: Modified - name: Modified305 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137293,7 +137293,7 @@ stage: Modified - name: Modified306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137303,7 +137303,7 @@ stage: Modified - name: Modified307 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137325,7 +137325,7 @@ stage: Modified - name: Modified308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137335,7 +137335,7 @@ stage: Modified - name: Modified309 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137357,7 +137357,7 @@ stage: Modified - name: Modified310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -137366,7 +137366,7 @@ stage: Modified - name: Modified311 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137388,7 +137388,7 @@ stage: Modified - name: Modified312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -137397,7 +137397,7 @@ stage: Modified - name: Modified313 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1192\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137419,7 +137419,7 @@ stage: Modified - name: Modified314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1192\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1192\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137429,7 +137429,7 @@ stage: Modified - name: Modified315 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1193\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137451,7 +137451,7 @@ stage: Modified - name: Modified316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1193\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1193\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137461,7 +137461,7 @@ stage: Modified - name: Modified317 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1194\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137483,7 +137483,7 @@ stage: Modified - name: Modified318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1194\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1194\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -137492,7 +137492,7 @@ stage: Modified - name: Modified319 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1195\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137514,7 +137514,7 @@ stage: Modified - name: Modified320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1195\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1195\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -137523,7 +137523,7 @@ stage: Modified - name: Modified321 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1196\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137545,7 +137545,7 @@ stage: Modified - name: Modified322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1196\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1196\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137555,7 +137555,7 @@ stage: Modified - name: Modified323 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1197\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137577,7 +137577,7 @@ stage: Modified - name: Modified324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1197\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1197\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137587,7 +137587,7 @@ stage: Modified - name: Modified325 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1198\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137609,7 +137609,7 @@ stage: Modified - name: Modified326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1198\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1198\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -137618,7 +137618,7 @@ stage: Modified - name: Modified327 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1199\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137640,7 +137640,7 @@ stage: Modified - name: Modified328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1199\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1199\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -137649,7 +137649,7 @@ stage: Modified - name: Modified329 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816893,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key", "arch": "[x64]", "timestamp": 1606816893, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137657,7 +137657,7 @@ stage: Modified - name: Modified330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816893,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816893, "attributes": @@ -137667,7 +137667,7 @@ stage: Modified - name: Modified331 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137675,7 +137675,7 @@ stage: Modified - name: Modified332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -137685,7 +137685,7 @@ stage: Modified - name: Modified333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137693,7 +137693,7 @@ stage: Modified - name: Modified334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -137702,7 +137702,7 @@ stage: Modified - name: Modified335 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137710,7 +137710,7 @@ stage: Modified - name: Modified336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -137719,7 +137719,7 @@ stage: Modified - name: Modified337 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137727,7 +137727,7 @@ stage: Modified - name: Modified338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -137737,7 +137737,7 @@ stage: Modified - name: Modified339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137745,7 +137745,7 @@ stage: Modified - name: Modified340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -137755,7 +137755,7 @@ stage: Modified - name: Modified341 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137763,7 +137763,7 @@ stage: Modified - name: Modified342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -137772,7 +137772,7 @@ stage: Modified - name: Modified343 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770004,"checksum":"2b93c2a1c291c32c93e22c1272609103071b0e4a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137780,7 +137780,7 @@ stage: Modified - name: Modified344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -137789,7 +137789,7 @@ stage: Modified - name: Modified345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137797,7 +137797,7 @@ stage: Modified - name: Modified346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1208\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -137807,7 +137807,7 @@ stage: Modified - name: Modified347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137815,7 +137815,7 @@ stage: Modified - name: Modified348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1209\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -137825,7 +137825,7 @@ stage: Modified - name: Modified349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137833,7 +137833,7 @@ stage: Modified - name: Modified350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1210\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -137842,7 +137842,7 @@ stage: Modified - name: Modified351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137850,7 +137850,7 @@ stage: Modified - name: Modified352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1211\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -137859,7 +137859,7 @@ stage: Modified - name: Modified353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137867,7 +137867,7 @@ stage: Modified - name: Modified354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1212\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -137877,7 +137877,7 @@ stage: Modified - name: Modified355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137885,7 +137885,7 @@ stage: Modified - name: Modified356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1213\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -137895,7 +137895,7 @@ stage: Modified - name: Modified357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137903,7 +137903,7 @@ stage: Modified - name: Modified358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1214\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -137912,7 +137912,7 @@ stage: Modified - name: Modified359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -137920,7 +137920,7 @@ stage: Modified - name: Modified360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1215\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -137929,7 +137929,7 @@ stage: Modified - name: Modified361 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137951,7 +137951,7 @@ stage: Modified - name: Modified362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -137961,7 +137961,7 @@ stage: Modified - name: Modified363 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -137983,7 +137983,7 @@ stage: Modified - name: Modified364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -137993,7 +137993,7 @@ stage: Modified - name: Modified365 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138015,7 +138015,7 @@ stage: Modified - name: Modified366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -138024,7 +138024,7 @@ stage: Modified - name: Modified367 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138046,7 +138046,7 @@ stage: Modified - name: Modified368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -138055,7 +138055,7 @@ stage: Modified - name: Modified369 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138077,7 +138077,7 @@ stage: Modified - name: Modified370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -138087,7 +138087,7 @@ stage: Modified - name: Modified371 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138109,7 +138109,7 @@ stage: Modified - name: Modified372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -138119,7 +138119,7 @@ stage: Modified - name: Modified373 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138141,7 +138141,7 @@ stage: Modified - name: Modified374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -138150,7 +138150,7 @@ stage: Modified - name: Modified375 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138172,7 +138172,7 @@ stage: Modified - name: Modified376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -138181,7 +138181,7 @@ stage: Modified - name: Modified377 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1224\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138203,7 +138203,7 @@ stage: Modified - name: Modified378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1224\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1224\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -138213,7 +138213,7 @@ stage: Modified - name: Modified379 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1225\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138235,7 +138235,7 @@ stage: Modified - name: Modified380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1225\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1225\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -138245,7 +138245,7 @@ stage: Modified - name: Modified381 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1226\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138267,7 +138267,7 @@ stage: Modified - name: Modified382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1226\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1226\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -138276,7 +138276,7 @@ stage: Modified - name: Modified383 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1227\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138298,7 +138298,7 @@ stage: Modified - name: Modified384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1227\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1227\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -138307,7 +138307,7 @@ stage: Modified - name: Modified385 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1228\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138329,7 +138329,7 @@ stage: Modified - name: Modified386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1228\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1228\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -138339,7 +138339,7 @@ stage: Modified - name: Modified387 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1229\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138361,7 +138361,7 @@ stage: Modified - name: Modified388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1229\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1229\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -138371,7 +138371,7 @@ stage: Modified - name: Modified389 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1230\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138393,7 +138393,7 @@ stage: Modified - name: Modified390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1230\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1230\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -138402,7 +138402,7 @@ stage: Modified - name: Modified391 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1231\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138424,7 +138424,7 @@ stage: Modified - name: Modified392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1231\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1231\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -138433,7 +138433,7 @@ stage: Modified - name: Modified393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -138441,7 +138441,7 @@ stage: Modified - name: Modified394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -138451,7 +138451,7 @@ stage: Modified - name: Modified395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -138459,7 +138459,7 @@ stage: Modified - name: Modified396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -138469,7 +138469,7 @@ stage: Modified - name: Modified397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -138477,7 +138477,7 @@ stage: Modified - name: Modified398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -138486,7 +138486,7 @@ stage: Modified - name: Modified399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -138494,7 +138494,7 @@ stage: Modified - name: Modified400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -138503,7 +138503,7 @@ stage: Modified - name: Modified401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816894,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key", "arch": "[x64]", "timestamp": 1606816894, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -138511,7 +138511,7 @@ stage: Modified - name: Modified402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816894,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816894, "attributes": @@ -138521,7 +138521,7 @@ stage: Modified - name: Modified403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key", "arch": "[x64]", "timestamp": 1606816895, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -138529,7 +138529,7 @@ stage: Modified - name: Modified404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -138539,7 +138539,7 @@ stage: Modified - name: Modified405 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key", "arch": "[x64]", "timestamp": 1606816895, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -138547,7 +138547,7 @@ stage: Modified - name: Modified406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -138556,7 +138556,7 @@ stage: Modified - name: Modified407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770005,"checksum":"5067d9ed4dabdefa2e47c958a1e6d99a66667105"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key", "arch": "[x64]", "timestamp": 1606816895, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -138564,7 +138564,7 @@ stage: Modified - name: Modified408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -138573,7 +138573,7 @@ stage: Modified - name: Modified409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1240\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1240\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -138583,7 +138583,7 @@ stage: Modified - name: Modified410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1241\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1241\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -138593,7 +138593,7 @@ stage: Modified - name: Modified411 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1242\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1242\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -138602,7 +138602,7 @@ stage: Modified - name: Modified412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1243\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1243\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -138611,7 +138611,7 @@ stage: Modified - name: Modified413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1244\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1244\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -138621,7 +138621,7 @@ stage: Modified - name: Modified414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1245\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1245\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -138631,7 +138631,7 @@ stage: Modified - name: Modified415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1246\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1246\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -138640,7 +138640,7 @@ stage: Modified - name: Modified416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1247\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1247\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -138649,7 +138649,7 @@ stage: Modified - name: Modified417 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138670,7 +138670,7 @@ stage: Modified - name: Modified418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -138680,7 +138680,7 @@ stage: Modified - name: Modified419 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138701,7 +138701,7 @@ stage: Modified - name: Modified420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -138711,7 +138711,7 @@ stage: Modified - name: Modified421 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138732,7 +138732,7 @@ stage: Modified - name: Modified422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -138741,7 +138741,7 @@ stage: Modified - name: Modified423 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138762,7 +138762,7 @@ stage: Modified - name: Modified424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -138771,7 +138771,7 @@ stage: Modified - name: Modified425 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138792,7 +138792,7 @@ stage: Modified - name: Modified426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -138802,7 +138802,7 @@ stage: Modified - name: Modified427 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138823,7 +138823,7 @@ stage: Modified - name: Modified428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -138833,7 +138833,7 @@ stage: Modified - name: Modified429 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138854,7 +138854,7 @@ stage: Modified - name: Modified430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -138863,7 +138863,7 @@ stage: Modified - name: Modified431 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138884,7 +138884,7 @@ stage: Modified - name: Modified432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -138893,7 +138893,7 @@ stage: Modified - name: Modified433 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1256\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138914,7 +138914,7 @@ stage: Modified - name: Modified434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1256\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1256\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -138924,7 +138924,7 @@ stage: Modified - name: Modified435 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1257\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138945,7 +138945,7 @@ stage: Modified - name: Modified436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1257\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1257\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -138955,7 +138955,7 @@ stage: Modified - name: Modified437 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1258\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -138976,7 +138976,7 @@ stage: Modified - name: Modified438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1258\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1258\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -138985,7 +138985,7 @@ stage: Modified - name: Modified439 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1259\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139006,7 +139006,7 @@ stage: Modified - name: Modified440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1259\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1259\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139015,7 +139015,7 @@ stage: Modified - name: Modified441 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1260\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139036,7 +139036,7 @@ stage: Modified - name: Modified442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1260\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1260\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -139046,7 +139046,7 @@ stage: Modified - name: Modified443 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1261\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139067,7 +139067,7 @@ stage: Modified - name: Modified444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1261\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1261\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -139077,7 +139077,7 @@ stage: Modified - name: Modified445 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1262\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139098,7 +139098,7 @@ stage: Modified - name: Modified446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1262\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1262\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -139107,7 +139107,7 @@ stage: Modified - name: Modified447 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1263\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139128,7 +139128,7 @@ stage: Modified - name: Modified448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1263\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1263\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -139137,14 +139137,14 @@ stage: Modified - name: Modified449 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key", "arch": "[x64]", "timestamp": 1606816895, "attributes": {"type": "registry_key", "mtime": 1606770006, "checksum": "6faf4558734ce8967ec0c9ab269aee52902ae3ee"}}' stage: Modified - name: Modified450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -139154,14 +139154,14 @@ stage: Modified - name: Modified451 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key", "arch": "[x64]", "timestamp": 1606816895, "attributes": {"type": "registry_key", "mtime": 1606770006, "checksum": "6faf4558734ce8967ec0c9ab269aee52902ae3ee"}}' stage: Modified - name: Modified452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -139171,14 +139171,14 @@ stage: Modified - name: Modified453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key", "arch": "[x64]", "timestamp": 1606816895, "attributes": {"type": "registry_key", "mtime": 1606770006, "checksum": "6faf4558734ce8967ec0c9ab269aee52902ae3ee"}}' stage: Modified - name: Modified454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139187,14 +139187,14 @@ stage: Modified - name: Modified455 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key", "arch": "[x64]", "timestamp": 1606816895, "attributes": {"type": "registry_key", "mtime": 1606770006, "checksum": "6faf4558734ce8967ec0c9ab269aee52902ae3ee"}}' stage: Modified - name: Modified456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139203,14 +139203,14 @@ stage: Modified - name: Modified457 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key", "arch": "[x64]", "timestamp": 1606816895, "attributes": {"type": "registry_key", "mtime": 1606770006, "checksum": "6faf4558734ce8967ec0c9ab269aee52902ae3ee"}}' stage: Modified - name: Modified458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -139220,14 +139220,14 @@ stage: Modified - name: Modified459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key", "arch": "[x64]", "timestamp": 1606816895, "attributes": {"type": "registry_key", "mtime": 1606770006, "checksum": "6faf4558734ce8967ec0c9ab269aee52902ae3ee"}}' stage: Modified - name: Modified460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -139237,14 +139237,14 @@ stage: Modified - name: Modified461 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key", "arch": "[x64]", "timestamp": 1606816895, "attributes": {"type": "registry_key", "mtime": 1606770006, "checksum": "6faf4558734ce8967ec0c9ab269aee52902ae3ee"}}' stage: Modified - name: Modified462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -139253,14 +139253,14 @@ stage: Modified - name: Modified463 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816895,"attributes":{"type":"registry_key","mtime":1606770006,"checksum":"6faf4558734ce8967ec0c9ab269aee52902ae3ee"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key", "arch": "[x64]", "timestamp": 1606816895, "attributes": {"type": "registry_key", "mtime": 1606770006, "checksum": "6faf4558734ce8967ec0c9ab269aee52902ae3ee"}}' stage: Modified - name: Modified464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -139269,7 +139269,7 @@ stage: Modified - name: Modified465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1272\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1272\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -139279,7 +139279,7 @@ stage: Modified - name: Modified466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1273\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1273\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -139289,7 +139289,7 @@ stage: Modified - name: Modified467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1274\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1274\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139298,7 +139298,7 @@ stage: Modified - name: Modified468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1275\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1275\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139307,7 +139307,7 @@ stage: Modified - name: Modified469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1276\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816895,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1276\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816895, "attributes": @@ -139317,7 +139317,7 @@ stage: Modified - name: Modified470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1277\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1277\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139327,7 +139327,7 @@ stage: Modified - name: Modified471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1278\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1278\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -139336,7 +139336,7 @@ stage: Modified - name: Modified472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1279\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1279\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -139345,7 +139345,7 @@ stage: Modified - name: Modified473 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139368,7 +139368,7 @@ stage: Modified - name: Modified474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139377,7 +139377,7 @@ stage: Modified - name: Modified475 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139400,7 +139400,7 @@ stage: Modified - name: Modified476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139409,7 +139409,7 @@ stage: Modified - name: Modified477 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139432,7 +139432,7 @@ stage: Modified - name: Modified478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139440,7 +139440,7 @@ stage: Modified - name: Modified479 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139463,7 +139463,7 @@ stage: Modified - name: Modified480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139471,7 +139471,7 @@ stage: Modified - name: Modified481 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139494,7 +139494,7 @@ stage: Modified - name: Modified482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139503,7 +139503,7 @@ stage: Modified - name: Modified483 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139526,7 +139526,7 @@ stage: Modified - name: Modified484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139535,7 +139535,7 @@ stage: Modified - name: Modified485 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139558,7 +139558,7 @@ stage: Modified - name: Modified486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139566,7 +139566,7 @@ stage: Modified - name: Modified487 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139589,7 +139589,7 @@ stage: Modified - name: Modified488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139597,7 +139597,7 @@ stage: Modified - name: Modified489 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1288\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139620,7 +139620,7 @@ stage: Modified - name: Modified490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1288\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1288\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139629,7 +139629,7 @@ stage: Modified - name: Modified491 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1289\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139652,7 +139652,7 @@ stage: Modified - name: Modified492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1289\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1289\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139661,7 +139661,7 @@ stage: Modified - name: Modified493 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1290\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139684,7 +139684,7 @@ stage: Modified - name: Modified494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1290\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1290\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139692,7 +139692,7 @@ stage: Modified - name: Modified495 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1291\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139715,7 +139715,7 @@ stage: Modified - name: Modified496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1291\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1291\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139723,7 +139723,7 @@ stage: Modified - name: Modified497 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1292\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139746,7 +139746,7 @@ stage: Modified - name: Modified498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1292\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1292\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139755,7 +139755,7 @@ stage: Modified - name: Modified499 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1293\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139778,7 +139778,7 @@ stage: Modified - name: Modified500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1293\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1293\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139787,7 +139787,7 @@ stage: Modified - name: Modified501 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1294\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139810,7 +139810,7 @@ stage: Modified - name: Modified502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1294\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1294\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139818,7 +139818,7 @@ stage: Modified - name: Modified503 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1295\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -139841,7 +139841,7 @@ stage: Modified - name: Modified504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1295\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1295\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139849,7 +139849,7 @@ stage: Modified - name: Modified505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -139858,7 +139858,7 @@ stage: Modified - name: Modified506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139867,7 +139867,7 @@ stage: Modified - name: Modified507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -139876,7 +139876,7 @@ stage: Modified - name: Modified508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139885,7 +139885,7 @@ stage: Modified - name: Modified509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -139894,7 +139894,7 @@ stage: Modified - name: Modified510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139902,7 +139902,7 @@ stage: Modified - name: Modified511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -139911,7 +139911,7 @@ stage: Modified - name: Modified512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139919,7 +139919,7 @@ stage: Modified - name: Modified513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -139928,7 +139928,7 @@ stage: Modified - name: Modified514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139937,7 +139937,7 @@ stage: Modified - name: Modified515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -139946,7 +139946,7 @@ stage: Modified - name: Modified516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -139955,7 +139955,7 @@ stage: Modified - name: Modified517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -139964,7 +139964,7 @@ stage: Modified - name: Modified518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139972,7 +139972,7 @@ stage: Modified - name: Modified519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770007,"checksum":"44c5044f8b584ae01a901e35b22f2782f590fa2a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -139981,7 +139981,7 @@ stage: Modified - name: Modified520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -139989,7 +139989,7 @@ stage: Modified - name: Modified521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -139998,7 +139998,7 @@ stage: Modified - name: Modified522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1304\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -140007,7 +140007,7 @@ stage: Modified - name: Modified523 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140016,7 +140016,7 @@ stage: Modified - name: Modified524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1305\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -140025,7 +140025,7 @@ stage: Modified - name: Modified525 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140034,7 +140034,7 @@ stage: Modified - name: Modified526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1306\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140042,7 +140042,7 @@ stage: Modified - name: Modified527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140051,7 +140051,7 @@ stage: Modified - name: Modified528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1307\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140059,7 +140059,7 @@ stage: Modified - name: Modified529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140068,7 +140068,7 @@ stage: Modified - name: Modified530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1308\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -140077,7 +140077,7 @@ stage: Modified - name: Modified531 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140086,7 +140086,7 @@ stage: Modified - name: Modified532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1309\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -140095,7 +140095,7 @@ stage: Modified - name: Modified533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140104,7 +140104,7 @@ stage: Modified - name: Modified534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1310\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140112,7 +140112,7 @@ stage: Modified - name: Modified535 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key", "arch": "[x64]", "timestamp": 1606816896, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140121,7 +140121,7 @@ stage: Modified - name: Modified536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1311\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140129,7 +140129,7 @@ stage: Modified - name: Modified537 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140151,7 +140151,7 @@ stage: Modified - name: Modified538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -140160,7 +140160,7 @@ stage: Modified - name: Modified539 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816896,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140182,7 +140182,7 @@ stage: Modified - name: Modified540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816896,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816896, "attributes": @@ -140191,7 +140191,7 @@ stage: Modified - name: Modified541 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140213,7 +140213,7 @@ stage: Modified - name: Modified542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140221,7 +140221,7 @@ stage: Modified - name: Modified543 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140243,7 +140243,7 @@ stage: Modified - name: Modified544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140251,7 +140251,7 @@ stage: Modified - name: Modified545 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140273,7 +140273,7 @@ stage: Modified - name: Modified546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140282,7 +140282,7 @@ stage: Modified - name: Modified547 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140304,7 +140304,7 @@ stage: Modified - name: Modified548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140313,7 +140313,7 @@ stage: Modified - name: Modified549 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140335,7 +140335,7 @@ stage: Modified - name: Modified550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140343,7 +140343,7 @@ stage: Modified - name: Modified551 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140365,7 +140365,7 @@ stage: Modified - name: Modified552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140373,7 +140373,7 @@ stage: Modified - name: Modified553 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1320\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140395,7 +140395,7 @@ stage: Modified - name: Modified554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1320\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1320\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140404,7 +140404,7 @@ stage: Modified - name: Modified555 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1321\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140426,7 +140426,7 @@ stage: Modified - name: Modified556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1321\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1321\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140435,7 +140435,7 @@ stage: Modified - name: Modified557 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1322\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140457,7 +140457,7 @@ stage: Modified - name: Modified558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1322\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1322\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140465,7 +140465,7 @@ stage: Modified - name: Modified559 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1323\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140487,7 +140487,7 @@ stage: Modified - name: Modified560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1323\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1323\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140495,7 +140495,7 @@ stage: Modified - name: Modified561 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1324\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140517,7 +140517,7 @@ stage: Modified - name: Modified562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1324\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1324\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140526,7 +140526,7 @@ stage: Modified - name: Modified563 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1325\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140548,7 +140548,7 @@ stage: Modified - name: Modified564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1325\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1325\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140557,7 +140557,7 @@ stage: Modified - name: Modified565 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1326\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140579,7 +140579,7 @@ stage: Modified - name: Modified566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1326\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1326\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140587,7 +140587,7 @@ stage: Modified - name: Modified567 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1327\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140609,7 +140609,7 @@ stage: Modified - name: Modified568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1327\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1327\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140617,7 +140617,7 @@ stage: Modified - name: Modified569 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140625,7 +140625,7 @@ stage: Modified - name: Modified570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140634,7 +140634,7 @@ stage: Modified - name: Modified571 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140642,7 +140642,7 @@ stage: Modified - name: Modified572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140651,7 +140651,7 @@ stage: Modified - name: Modified573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140659,7 +140659,7 @@ stage: Modified - name: Modified574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140667,7 +140667,7 @@ stage: Modified - name: Modified575 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140675,7 +140675,7 @@ stage: Modified - name: Modified576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140683,7 +140683,7 @@ stage: Modified - name: Modified577 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140691,7 +140691,7 @@ stage: Modified - name: Modified578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140700,7 +140700,7 @@ stage: Modified - name: Modified579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140708,7 +140708,7 @@ stage: Modified - name: Modified580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140717,7 +140717,7 @@ stage: Modified - name: Modified581 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140725,7 +140725,7 @@ stage: Modified - name: Modified582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140733,7 +140733,7 @@ stage: Modified - name: Modified583 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770009,"checksum":"99526fa09a99e347a9f550b5fa9b9e6914f68e71"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140741,7 +140741,7 @@ stage: Modified - name: Modified584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140749,7 +140749,7 @@ stage: Modified - name: Modified585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140757,7 +140757,7 @@ stage: Modified - name: Modified586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1336\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140766,7 +140766,7 @@ stage: Modified - name: Modified587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140774,7 +140774,7 @@ stage: Modified - name: Modified588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1337\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140783,7 +140783,7 @@ stage: Modified - name: Modified589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140791,7 +140791,7 @@ stage: Modified - name: Modified590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1338\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140799,7 +140799,7 @@ stage: Modified - name: Modified591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140807,7 +140807,7 @@ stage: Modified - name: Modified592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1339\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140815,7 +140815,7 @@ stage: Modified - name: Modified593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140823,7 +140823,7 @@ stage: Modified - name: Modified594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1340\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140832,7 +140832,7 @@ stage: Modified - name: Modified595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140840,7 +140840,7 @@ stage: Modified - name: Modified596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1341\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140849,7 +140849,7 @@ stage: Modified - name: Modified597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140857,7 +140857,7 @@ stage: Modified - name: Modified598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1342\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140865,7 +140865,7 @@ stage: Modified - name: Modified599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key", "arch": "[x64]", "timestamp": 1606816897, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -140873,7 +140873,7 @@ stage: Modified - name: Modified600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1343\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140881,7 +140881,7 @@ stage: Modified - name: Modified601 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140903,7 +140903,7 @@ stage: Modified - name: Modified602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140912,7 +140912,7 @@ stage: Modified - name: Modified603 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140934,7 +140934,7 @@ stage: Modified - name: Modified604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -140943,7 +140943,7 @@ stage: Modified - name: Modified605 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140965,7 +140965,7 @@ stage: Modified - name: Modified606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -140973,7 +140973,7 @@ stage: Modified - name: Modified607 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -140995,7 +140995,7 @@ stage: Modified - name: Modified608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141003,7 +141003,7 @@ stage: Modified - name: Modified609 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141025,7 +141025,7 @@ stage: Modified - name: Modified610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -141034,7 +141034,7 @@ stage: Modified - name: Modified611 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816897,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141056,7 +141056,7 @@ stage: Modified - name: Modified612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816897,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816897, "attributes": @@ -141065,7 +141065,7 @@ stage: Modified - name: Modified613 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141087,7 +141087,7 @@ stage: Modified - name: Modified614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141095,7 +141095,7 @@ stage: Modified - name: Modified615 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141117,7 +141117,7 @@ stage: Modified - name: Modified616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141125,7 +141125,7 @@ stage: Modified - name: Modified617 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1352\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141147,7 +141147,7 @@ stage: Modified - name: Modified618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1352\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1352\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141156,7 +141156,7 @@ stage: Modified - name: Modified619 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1353\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141178,7 +141178,7 @@ stage: Modified - name: Modified620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1353\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1353\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141187,7 +141187,7 @@ stage: Modified - name: Modified621 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1354\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141209,7 +141209,7 @@ stage: Modified - name: Modified622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1354\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1354\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141217,7 +141217,7 @@ stage: Modified - name: Modified623 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1355\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141239,7 +141239,7 @@ stage: Modified - name: Modified624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1355\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1355\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141247,7 +141247,7 @@ stage: Modified - name: Modified625 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1356\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141269,7 +141269,7 @@ stage: Modified - name: Modified626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1356\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1356\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141278,7 +141278,7 @@ stage: Modified - name: Modified627 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1357\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141300,7 +141300,7 @@ stage: Modified - name: Modified628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1357\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1357\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141309,7 +141309,7 @@ stage: Modified - name: Modified629 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1358\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141331,7 +141331,7 @@ stage: Modified - name: Modified630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1358\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1358\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141339,7 +141339,7 @@ stage: Modified - name: Modified631 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1359\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141361,7 +141361,7 @@ stage: Modified - name: Modified632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1359\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1359\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141369,7 +141369,7 @@ stage: Modified - name: Modified633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key", "arch": "[x64]", "timestamp": 1606816898, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -141377,7 +141377,7 @@ stage: Modified - name: Modified634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141386,7 +141386,7 @@ stage: Modified - name: Modified635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key", "arch": "[x64]", "timestamp": 1606816898, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -141394,7 +141394,7 @@ stage: Modified - name: Modified636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141403,7 +141403,7 @@ stage: Modified - name: Modified637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key", "arch": "[x64]", "timestamp": 1606816898, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -141411,7 +141411,7 @@ stage: Modified - name: Modified638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141419,7 +141419,7 @@ stage: Modified - name: Modified639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key", "arch": "[x64]", "timestamp": 1606816898, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -141427,7 +141427,7 @@ stage: Modified - name: Modified640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141435,7 +141435,7 @@ stage: Modified - name: Modified641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key", "arch": "[x64]", "timestamp": 1606816898, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -141443,7 +141443,7 @@ stage: Modified - name: Modified642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141452,7 +141452,7 @@ stage: Modified - name: Modified643 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key", "arch": "[x64]", "timestamp": 1606816898, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -141460,7 +141460,7 @@ stage: Modified - name: Modified644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141469,7 +141469,7 @@ stage: Modified - name: Modified645 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key", "arch": "[x64]", "timestamp": 1606816898, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -141477,7 +141477,7 @@ stage: Modified - name: Modified646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141485,7 +141485,7 @@ stage: Modified - name: Modified647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770010,"checksum":"d55c930b8a44f119cd09cba27729f5e44162fb6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key", "arch": "[x64]", "timestamp": 1606816898, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -141493,7 +141493,7 @@ stage: Modified - name: Modified648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141501,7 +141501,7 @@ stage: Modified - name: Modified649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1368\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1368\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141510,7 +141510,7 @@ stage: Modified - name: Modified650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1369\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1369\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141519,7 +141519,7 @@ stage: Modified - name: Modified651 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1370\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1370\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141527,7 +141527,7 @@ stage: Modified - name: Modified652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1371\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1371\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141535,7 +141535,7 @@ stage: Modified - name: Modified653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1372\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1372\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141544,7 +141544,7 @@ stage: Modified - name: Modified654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1373\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1373\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141553,7 +141553,7 @@ stage: Modified - name: Modified655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1374\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1374\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141561,7 +141561,7 @@ stage: Modified - name: Modified656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1375\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1375\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141569,7 +141569,7 @@ stage: Modified - name: Modified657 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141590,7 +141590,7 @@ stage: Modified - name: Modified658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141599,7 +141599,7 @@ stage: Modified - name: Modified659 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141620,7 +141620,7 @@ stage: Modified - name: Modified660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141629,7 +141629,7 @@ stage: Modified - name: Modified661 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141650,7 +141650,7 @@ stage: Modified - name: Modified662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141658,7 +141658,7 @@ stage: Modified - name: Modified663 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141679,7 +141679,7 @@ stage: Modified - name: Modified664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141687,7 +141687,7 @@ stage: Modified - name: Modified665 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141708,7 +141708,7 @@ stage: Modified - name: Modified666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141717,7 +141717,7 @@ stage: Modified - name: Modified667 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141738,7 +141738,7 @@ stage: Modified - name: Modified668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141747,7 +141747,7 @@ stage: Modified - name: Modified669 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141768,7 +141768,7 @@ stage: Modified - name: Modified670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141776,7 +141776,7 @@ stage: Modified - name: Modified671 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141797,7 +141797,7 @@ stage: Modified - name: Modified672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141805,7 +141805,7 @@ stage: Modified - name: Modified673 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1384\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141826,7 +141826,7 @@ stage: Modified - name: Modified674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1384\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1384\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141835,7 +141835,7 @@ stage: Modified - name: Modified675 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1385\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816898,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141856,7 +141856,7 @@ stage: Modified - name: Modified676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1385\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816898,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1385\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816898, "attributes": @@ -141865,7 +141865,7 @@ stage: Modified - name: Modified677 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1386\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141886,7 +141886,7 @@ stage: Modified - name: Modified678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1386\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1386\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141894,7 +141894,7 @@ stage: Modified - name: Modified679 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1387\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141915,7 +141915,7 @@ stage: Modified - name: Modified680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1387\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1387\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -141923,7 +141923,7 @@ stage: Modified - name: Modified681 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1388\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141944,7 +141944,7 @@ stage: Modified - name: Modified682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1388\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1388\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -141953,7 +141953,7 @@ stage: Modified - name: Modified683 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1389\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -141974,7 +141974,7 @@ stage: Modified - name: Modified684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1389\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1389\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -141983,7 +141983,7 @@ stage: Modified - name: Modified685 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1390\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142004,7 +142004,7 @@ stage: Modified - name: Modified686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1390\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1390\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142012,7 +142012,7 @@ stage: Modified - name: Modified687 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1391\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142033,7 +142033,7 @@ stage: Modified - name: Modified688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1391\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1391\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142041,14 +142041,14 @@ stage: Modified - name: Modified689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key", "arch": "[x64]", "timestamp": 1606816899, "attributes": {"type": "registry_key", "mtime": 1606770011, "checksum": "94f879dd712fde46492023c732ecec62b5e6ac13"}}' stage: Modified - name: Modified690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142057,14 +142057,14 @@ stage: Modified - name: Modified691 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key", "arch": "[x64]", "timestamp": 1606816899, "attributes": {"type": "registry_key", "mtime": 1606770011, "checksum": "94f879dd712fde46492023c732ecec62b5e6ac13"}}' stage: Modified - name: Modified692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142073,14 +142073,14 @@ stage: Modified - name: Modified693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key", "arch": "[x64]", "timestamp": 1606816899, "attributes": {"type": "registry_key", "mtime": 1606770011, "checksum": "94f879dd712fde46492023c732ecec62b5e6ac13"}}' stage: Modified - name: Modified694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142088,14 +142088,14 @@ stage: Modified - name: Modified695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key", "arch": "[x64]", "timestamp": 1606816899, "attributes": {"type": "registry_key", "mtime": 1606770011, "checksum": "94f879dd712fde46492023c732ecec62b5e6ac13"}}' stage: Modified - name: Modified696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142103,14 +142103,14 @@ stage: Modified - name: Modified697 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key", "arch": "[x64]", "timestamp": 1606816899, "attributes": {"type": "registry_key", "mtime": 1606770011, "checksum": "94f879dd712fde46492023c732ecec62b5e6ac13"}}' stage: Modified - name: Modified698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142119,14 +142119,14 @@ stage: Modified - name: Modified699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key", "arch": "[x64]", "timestamp": 1606816899, "attributes": {"type": "registry_key", "mtime": 1606770011, "checksum": "94f879dd712fde46492023c732ecec62b5e6ac13"}}' stage: Modified - name: Modified700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142135,14 +142135,14 @@ stage: Modified - name: Modified701 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key", "arch": "[x64]", "timestamp": 1606816899, "attributes": {"type": "registry_key", "mtime": 1606770011, "checksum": "94f879dd712fde46492023c732ecec62b5e6ac13"}}' stage: Modified - name: Modified702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142150,14 +142150,14 @@ stage: Modified - name: Modified703 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","mtime":1606770011,"checksum":"94f879dd712fde46492023c732ecec62b5e6ac13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key", "arch": "[x64]", "timestamp": 1606816899, "attributes": {"type": "registry_key", "mtime": 1606770011, "checksum": "94f879dd712fde46492023c732ecec62b5e6ac13"}}' stage: Modified - name: Modified704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142165,7 +142165,7 @@ stage: Modified - name: Modified705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1400\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1400\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142174,7 +142174,7 @@ stage: Modified - name: Modified706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1401\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1401\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142183,7 +142183,7 @@ stage: Modified - name: Modified707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1402\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1402\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142191,7 +142191,7 @@ stage: Modified - name: Modified708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1403\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1403\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142199,7 +142199,7 @@ stage: Modified - name: Modified709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1404\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1404\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142208,7 +142208,7 @@ stage: Modified - name: Modified710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1405\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1405\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142217,7 +142217,7 @@ stage: Modified - name: Modified711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1406\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1406\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142225,7 +142225,7 @@ stage: Modified - name: Modified712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1407\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1407\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142233,7 +142233,7 @@ stage: Modified - name: Modified713 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142256,7 +142256,7 @@ stage: Modified - name: Modified714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142265,7 +142265,7 @@ stage: Modified - name: Modified715 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142288,7 +142288,7 @@ stage: Modified - name: Modified716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142297,7 +142297,7 @@ stage: Modified - name: Modified717 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142320,7 +142320,7 @@ stage: Modified - name: Modified718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142328,7 +142328,7 @@ stage: Modified - name: Modified719 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142351,7 +142351,7 @@ stage: Modified - name: Modified720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142359,7 +142359,7 @@ stage: Modified - name: Modified721 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142382,7 +142382,7 @@ stage: Modified - name: Modified722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142391,7 +142391,7 @@ stage: Modified - name: Modified723 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142414,7 +142414,7 @@ stage: Modified - name: Modified724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142423,7 +142423,7 @@ stage: Modified - name: Modified725 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142446,7 +142446,7 @@ stage: Modified - name: Modified726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -142454,7 +142454,7 @@ stage: Modified - name: Modified727 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142477,7 +142477,7 @@ stage: Modified - name: Modified728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -142485,7 +142485,7 @@ stage: Modified - name: Modified729 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1416\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142508,7 +142508,7 @@ stage: Modified - name: Modified730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1416\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1416\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142517,7 +142517,7 @@ stage: Modified - name: Modified731 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1417\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142540,7 +142540,7 @@ stage: Modified - name: Modified732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1417\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1417\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142549,7 +142549,7 @@ stage: Modified - name: Modified733 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1418\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142572,7 +142572,7 @@ stage: Modified - name: Modified734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1418\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1418\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142580,7 +142580,7 @@ stage: Modified - name: Modified735 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1419\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142603,7 +142603,7 @@ stage: Modified - name: Modified736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1419\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1419\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142611,7 +142611,7 @@ stage: Modified - name: Modified737 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1420\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142634,7 +142634,7 @@ stage: Modified - name: Modified738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1420\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1420\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142643,7 +142643,7 @@ stage: Modified - name: Modified739 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1421\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816899,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142666,7 +142666,7 @@ stage: Modified - name: Modified740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1421\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816899,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1421\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816899, "attributes": @@ -142675,7 +142675,7 @@ stage: Modified - name: Modified741 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1422\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142698,7 +142698,7 @@ stage: Modified - name: Modified742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1422\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1422\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -142706,7 +142706,7 @@ stage: Modified - name: Modified743 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1423\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -142729,7 +142729,7 @@ stage: Modified - name: Modified744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1423\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1423\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -142737,7 +142737,7 @@ stage: Modified - name: Modified745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770012,"checksum":"8e23d7a5bf9abfc3c85067fcefbe8f6ad12616ab"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770012,"checksum":"8e23d7a5bf9abfc3c85067fcefbe8f6ad12616ab"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142746,7 +142746,7 @@ stage: Modified - name: Modified746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -142755,7 +142755,7 @@ stage: Modified - name: Modified747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770012,"checksum":"8e23d7a5bf9abfc3c85067fcefbe8f6ad12616ab"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770012,"checksum":"8e23d7a5bf9abfc3c85067fcefbe8f6ad12616ab"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142764,7 +142764,7 @@ stage: Modified - name: Modified748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -142773,7 +142773,7 @@ stage: Modified - name: Modified749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770012,"checksum":"8e23d7a5bf9abfc3c85067fcefbe8f6ad12616ab"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770012,"checksum":"8e23d7a5bf9abfc3c85067fcefbe8f6ad12616ab"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142782,7 +142782,7 @@ stage: Modified - name: Modified750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142790,7 +142790,7 @@ stage: Modified - name: Modified751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770012,"checksum":"8e23d7a5bf9abfc3c85067fcefbe8f6ad12616ab"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770012,"checksum":"8e23d7a5bf9abfc3c85067fcefbe8f6ad12616ab"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142799,7 +142799,7 @@ stage: Modified - name: Modified752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142807,7 +142807,7 @@ stage: Modified - name: Modified753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770012,"checksum":"8e23d7a5bf9abfc3c85067fcefbe8f6ad12616ab"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770012,"checksum":"8e23d7a5bf9abfc3c85067fcefbe8f6ad12616ab"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142816,7 +142816,7 @@ stage: Modified - name: Modified754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -142825,7 +142825,7 @@ stage: Modified - name: Modified755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770013,"checksum":"d2a9317a0adced5f9acd1c50d9f0fd664d5e4427"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770013,"checksum":"d2a9317a0adced5f9acd1c50d9f0fd664d5e4427"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142834,7 +142834,7 @@ stage: Modified - name: Modified756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -142843,7 +142843,7 @@ stage: Modified - name: Modified757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770013,"checksum":"d2a9317a0adced5f9acd1c50d9f0fd664d5e4427"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770013,"checksum":"d2a9317a0adced5f9acd1c50d9f0fd664d5e4427"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142852,7 +142852,7 @@ stage: Modified - name: Modified758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -142860,7 +142860,7 @@ stage: Modified - name: Modified759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770013,"checksum":"d2a9317a0adced5f9acd1c50d9f0fd664d5e4427"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770013,"checksum":"d2a9317a0adced5f9acd1c50d9f0fd664d5e4427"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142869,7 +142869,7 @@ stage: Modified - name: Modified760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -142877,7 +142877,7 @@ stage: Modified - name: Modified761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142886,7 +142886,7 @@ stage: Modified - name: Modified762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1432\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -142895,7 +142895,7 @@ stage: Modified - name: Modified763 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142904,7 +142904,7 @@ stage: Modified - name: Modified764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1433\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -142913,7 +142913,7 @@ stage: Modified - name: Modified765 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142922,7 +142922,7 @@ stage: Modified - name: Modified766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1434\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142930,7 +142930,7 @@ stage: Modified - name: Modified767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142939,7 +142939,7 @@ stage: Modified - name: Modified768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1435\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -142947,7 +142947,7 @@ stage: Modified - name: Modified769 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142956,7 +142956,7 @@ stage: Modified - name: Modified770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1436\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -142965,7 +142965,7 @@ stage: Modified - name: Modified771 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142974,7 +142974,7 @@ stage: Modified - name: Modified772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1437\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -142983,7 +142983,7 @@ stage: Modified - name: Modified773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -142992,7 +142992,7 @@ stage: Modified - name: Modified774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1438\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -143000,7 +143000,7 @@ stage: Modified - name: Modified775 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143009,7 +143009,7 @@ stage: Modified - name: Modified776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1439\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -143017,7 +143017,7 @@ stage: Modified - name: Modified777 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143039,7 +143039,7 @@ stage: Modified - name: Modified778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -143048,7 +143048,7 @@ stage: Modified - name: Modified779 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143070,7 +143070,7 @@ stage: Modified - name: Modified780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -143079,7 +143079,7 @@ stage: Modified - name: Modified781 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143101,7 +143101,7 @@ stage: Modified - name: Modified782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -143109,7 +143109,7 @@ stage: Modified - name: Modified783 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143131,7 +143131,7 @@ stage: Modified - name: Modified784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -143139,7 +143139,7 @@ stage: Modified - name: Modified785 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143161,7 +143161,7 @@ stage: Modified - name: Modified786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -143170,7 +143170,7 @@ stage: Modified - name: Modified787 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143192,7 +143192,7 @@ stage: Modified - name: Modified788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -143201,7 +143201,7 @@ stage: Modified - name: Modified789 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143223,7 +143223,7 @@ stage: Modified - name: Modified790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -143231,7 +143231,7 @@ stage: Modified - name: Modified791 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143253,7 +143253,7 @@ stage: Modified - name: Modified792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -143261,7 +143261,7 @@ stage: Modified - name: Modified793 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1448\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143283,7 +143283,7 @@ stage: Modified - name: Modified794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1448\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1448\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -143292,7 +143292,7 @@ stage: Modified - name: Modified795 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1449\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143314,7 +143314,7 @@ stage: Modified - name: Modified796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1449\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1449\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -143323,7 +143323,7 @@ stage: Modified - name: Modified797 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1450\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143345,7 +143345,7 @@ stage: Modified - name: Modified798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1450\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1450\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -143353,7 +143353,7 @@ stage: Modified - name: Modified799 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1451\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143375,7 +143375,7 @@ stage: Modified - name: Modified800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1451\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1451\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -143383,7 +143383,7 @@ stage: Modified - name: Modified801 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1452\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143405,7 +143405,7 @@ stage: Modified - name: Modified802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1452\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1452\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -143414,7 +143414,7 @@ stage: Modified - name: Modified803 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1453\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143436,7 +143436,7 @@ stage: Modified - name: Modified804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1453\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1453\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -143445,7 +143445,7 @@ stage: Modified - name: Modified805 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1454\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143467,7 +143467,7 @@ stage: Modified - name: Modified806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1454\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1454\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -143475,7 +143475,7 @@ stage: Modified - name: Modified807 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1455\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143497,7 +143497,7 @@ stage: Modified - name: Modified808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1455\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1455\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -143505,7 +143505,7 @@ stage: Modified - name: Modified809 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143513,7 +143513,7 @@ stage: Modified - name: Modified810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -143522,7 +143522,7 @@ stage: Modified - name: Modified811 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816900,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key", "arch": "[x64]", "timestamp": 1606816900, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143530,7 +143530,7 @@ stage: Modified - name: Modified812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816900,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816900, "attributes": @@ -143539,7 +143539,7 @@ stage: Modified - name: Modified813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143547,7 +143547,7 @@ stage: Modified - name: Modified814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -143555,7 +143555,7 @@ stage: Modified - name: Modified815 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143563,7 +143563,7 @@ stage: Modified - name: Modified816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -143571,7 +143571,7 @@ stage: Modified - name: Modified817 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143579,7 +143579,7 @@ stage: Modified - name: Modified818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -143588,7 +143588,7 @@ stage: Modified - name: Modified819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143596,7 +143596,7 @@ stage: Modified - name: Modified820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -143605,7 +143605,7 @@ stage: Modified - name: Modified821 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143613,7 +143613,7 @@ stage: Modified - name: Modified822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -143621,7 +143621,7 @@ stage: Modified - name: Modified823 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770014,"checksum":"79e6188582a640b0e69ca821835c636def52060b"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143629,7 +143629,7 @@ stage: Modified - name: Modified824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -143637,7 +143637,7 @@ stage: Modified - name: Modified825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143645,7 +143645,7 @@ stage: Modified - name: Modified826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1464\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -143654,7 +143654,7 @@ stage: Modified - name: Modified827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143662,7 +143662,7 @@ stage: Modified - name: Modified828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1465\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -143671,7 +143671,7 @@ stage: Modified - name: Modified829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143679,7 +143679,7 @@ stage: Modified - name: Modified830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1466\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -143687,7 +143687,7 @@ stage: Modified - name: Modified831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143695,7 +143695,7 @@ stage: Modified - name: Modified832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1467\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -143703,7 +143703,7 @@ stage: Modified - name: Modified833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143711,7 +143711,7 @@ stage: Modified - name: Modified834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1468\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -143720,7 +143720,7 @@ stage: Modified - name: Modified835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143728,7 +143728,7 @@ stage: Modified - name: Modified836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1469\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -143737,7 +143737,7 @@ stage: Modified - name: Modified837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143745,7 +143745,7 @@ stage: Modified - name: Modified838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1470\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -143753,7 +143753,7 @@ stage: Modified - name: Modified839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -143761,7 +143761,7 @@ stage: Modified - name: Modified840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1471\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -143769,7 +143769,7 @@ stage: Modified - name: Modified841 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143791,7 +143791,7 @@ stage: Modified - name: Modified842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -143800,7 +143800,7 @@ stage: Modified - name: Modified843 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143822,7 +143822,7 @@ stage: Modified - name: Modified844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -143831,7 +143831,7 @@ stage: Modified - name: Modified845 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143853,7 +143853,7 @@ stage: Modified - name: Modified846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -143861,7 +143861,7 @@ stage: Modified - name: Modified847 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143883,7 +143883,7 @@ stage: Modified - name: Modified848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -143891,7 +143891,7 @@ stage: Modified - name: Modified849 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143913,7 +143913,7 @@ stage: Modified - name: Modified850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -143922,7 +143922,7 @@ stage: Modified - name: Modified851 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143944,7 +143944,7 @@ stage: Modified - name: Modified852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -143953,7 +143953,7 @@ stage: Modified - name: Modified853 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -143975,7 +143975,7 @@ stage: Modified - name: Modified854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -143983,7 +143983,7 @@ stage: Modified - name: Modified855 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144005,7 +144005,7 @@ stage: Modified - name: Modified856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -144013,7 +144013,7 @@ stage: Modified - name: Modified857 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1480\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144035,7 +144035,7 @@ stage: Modified - name: Modified858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1480\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1480\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -144044,7 +144044,7 @@ stage: Modified - name: Modified859 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1481\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144066,7 +144066,7 @@ stage: Modified - name: Modified860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1481\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1481\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -144075,7 +144075,7 @@ stage: Modified - name: Modified861 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1482\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144097,7 +144097,7 @@ stage: Modified - name: Modified862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1482\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1482\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144105,7 +144105,7 @@ stage: Modified - name: Modified863 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1483\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144127,7 +144127,7 @@ stage: Modified - name: Modified864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1483\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1483\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144135,7 +144135,7 @@ stage: Modified - name: Modified865 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1484\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144157,7 +144157,7 @@ stage: Modified - name: Modified866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1484\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1484\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -144166,7 +144166,7 @@ stage: Modified - name: Modified867 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1485\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144188,7 +144188,7 @@ stage: Modified - name: Modified868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1485\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1485\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -144197,7 +144197,7 @@ stage: Modified - name: Modified869 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1486\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144219,7 +144219,7 @@ stage: Modified - name: Modified870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1486\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1486\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -144227,7 +144227,7 @@ stage: Modified - name: Modified871 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1487\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144249,7 +144249,7 @@ stage: Modified - name: Modified872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1487\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1487\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -144257,7 +144257,7 @@ stage: Modified - name: Modified873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770014,"checksum":"e73ed7a7b19d7d6de1bd274bf5587237f2e9ce29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770014,"checksum":"e73ed7a7b19d7d6de1bd274bf5587237f2e9ce29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -144265,7 +144265,7 @@ stage: Modified - name: Modified874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -144274,7 +144274,7 @@ stage: Modified - name: Modified875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -144282,7 +144282,7 @@ stage: Modified - name: Modified876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -144291,7 +144291,7 @@ stage: Modified - name: Modified877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -144299,7 +144299,7 @@ stage: Modified - name: Modified878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144307,7 +144307,7 @@ stage: Modified - name: Modified879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -144315,7 +144315,7 @@ stage: Modified - name: Modified880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144323,7 +144323,7 @@ stage: Modified - name: Modified881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -144331,7 +144331,7 @@ stage: Modified - name: Modified882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -144340,7 +144340,7 @@ stage: Modified - name: Modified883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -144348,7 +144348,7 @@ stage: Modified - name: Modified884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -144357,7 +144357,7 @@ stage: Modified - name: Modified885 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -144365,7 +144365,7 @@ stage: Modified - name: Modified886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -144373,7 +144373,7 @@ stage: Modified - name: Modified887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816901,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770015,"checksum":"8ea3a5afe4f4468c716e3bdb62b2ee93fd634d5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key", "arch": "[x64]", "timestamp": 1606816901, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -144381,7 +144381,7 @@ stage: Modified - name: Modified888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -144389,7 +144389,7 @@ stage: Modified - name: Modified889 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1496\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816901,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1496\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816901, "attributes": @@ -144398,7 +144398,7 @@ stage: Modified - name: Modified890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1497\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1497\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144407,7 +144407,7 @@ stage: Modified - name: Modified891 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1498\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1498\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144415,7 +144415,7 @@ stage: Modified - name: Modified892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1499\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1499\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144423,7 +144423,7 @@ stage: Modified - name: Modified893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1500\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1500\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144432,7 +144432,7 @@ stage: Modified - name: Modified894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1501\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1501\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144441,7 +144441,7 @@ stage: Modified - name: Modified895 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1502\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1502\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -144449,7 +144449,7 @@ stage: Modified - name: Modified896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1503\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1503\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -144457,7 +144457,7 @@ stage: Modified - name: Modified897 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144478,7 +144478,7 @@ stage: Modified - name: Modified898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144487,7 +144487,7 @@ stage: Modified - name: Modified899 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144508,7 +144508,7 @@ stage: Modified - name: Modified900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144517,7 +144517,7 @@ stage: Modified - name: Modified901 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144538,7 +144538,7 @@ stage: Modified - name: Modified902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144546,7 +144546,7 @@ stage: Modified - name: Modified903 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144567,7 +144567,7 @@ stage: Modified - name: Modified904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144575,7 +144575,7 @@ stage: Modified - name: Modified905 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144596,7 +144596,7 @@ stage: Modified - name: Modified906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144605,7 +144605,7 @@ stage: Modified - name: Modified907 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144626,7 +144626,7 @@ stage: Modified - name: Modified908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144635,7 +144635,7 @@ stage: Modified - name: Modified909 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144656,7 +144656,7 @@ stage: Modified - name: Modified910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -144664,7 +144664,7 @@ stage: Modified - name: Modified911 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144685,7 +144685,7 @@ stage: Modified - name: Modified912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -144693,7 +144693,7 @@ stage: Modified - name: Modified913 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1512\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144714,7 +144714,7 @@ stage: Modified - name: Modified914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1512\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1512\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144723,7 +144723,7 @@ stage: Modified - name: Modified915 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1513\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144744,7 +144744,7 @@ stage: Modified - name: Modified916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1513\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1513\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144753,7 +144753,7 @@ stage: Modified - name: Modified917 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1514\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144774,7 +144774,7 @@ stage: Modified - name: Modified918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1514\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1514\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144782,7 +144782,7 @@ stage: Modified - name: Modified919 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1515\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144803,7 +144803,7 @@ stage: Modified - name: Modified920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1515\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1515\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144811,7 +144811,7 @@ stage: Modified - name: Modified921 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1516\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144832,7 +144832,7 @@ stage: Modified - name: Modified922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1516\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1516\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144841,7 +144841,7 @@ stage: Modified - name: Modified923 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1517\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144862,7 +144862,7 @@ stage: Modified - name: Modified924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1517\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1517\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144871,7 +144871,7 @@ stage: Modified - name: Modified925 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1518\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144892,7 +144892,7 @@ stage: Modified - name: Modified926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1518\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1518\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -144900,7 +144900,7 @@ stage: Modified - name: Modified927 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1519\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -144921,7 +144921,7 @@ stage: Modified - name: Modified928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1519\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1519\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -144929,14 +144929,14 @@ stage: Modified - name: Modified929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key", "arch": "[x64]", "timestamp": 1606816902, "attributes": {"type": "registry_key", "mtime": 1606770015, "checksum": "8b32eeb8eff117c5d40ae11aca954ca5577ce31e"}}' stage: Modified - name: Modified930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144945,14 +144945,14 @@ stage: Modified - name: Modified931 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key", "arch": "[x64]", "timestamp": 1606816902, "attributes": {"type": "registry_key", "mtime": 1606770015, "checksum": "8b32eeb8eff117c5d40ae11aca954ca5577ce31e"}}' stage: Modified - name: Modified932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -144961,14 +144961,14 @@ stage: Modified - name: Modified933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key", "arch": "[x64]", "timestamp": 1606816902, "attributes": {"type": "registry_key", "mtime": 1606770015, "checksum": "8b32eeb8eff117c5d40ae11aca954ca5577ce31e"}}' stage: Modified - name: Modified934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144976,14 +144976,14 @@ stage: Modified - name: Modified935 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key", "arch": "[x64]", "timestamp": 1606816902, "attributes": {"type": "registry_key", "mtime": 1606770015, "checksum": "8b32eeb8eff117c5d40ae11aca954ca5577ce31e"}}' stage: Modified - name: Modified936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -144991,14 +144991,14 @@ stage: Modified - name: Modified937 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key", "arch": "[x64]", "timestamp": 1606816902, "attributes": {"type": "registry_key", "mtime": 1606770015, "checksum": "8b32eeb8eff117c5d40ae11aca954ca5577ce31e"}}' stage: Modified - name: Modified938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -145007,14 +145007,14 @@ stage: Modified - name: Modified939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key", "arch": "[x64]", "timestamp": 1606816902, "attributes": {"type": "registry_key", "mtime": 1606770015, "checksum": "8b32eeb8eff117c5d40ae11aca954ca5577ce31e"}}' stage: Modified - name: Modified940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -145023,14 +145023,14 @@ stage: Modified - name: Modified941 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key", "arch": "[x64]", "timestamp": 1606816902, "attributes": {"type": "registry_key", "mtime": 1606770015, "checksum": "8b32eeb8eff117c5d40ae11aca954ca5577ce31e"}}' stage: Modified - name: Modified942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -145038,14 +145038,14 @@ stage: Modified - name: Modified943 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816902,"attributes":{"type":"registry_key","mtime":1606770015,"checksum":"8b32eeb8eff117c5d40ae11aca954ca5577ce31e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key", "arch": "[x64]", "timestamp": 1606816902, "attributes": {"type": "registry_key", "mtime": 1606770015, "checksum": "8b32eeb8eff117c5d40ae11aca954ca5577ce31e"}}' stage: Modified - name: Modified944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -145053,7 +145053,7 @@ stage: Modified - name: Modified945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1528\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1528\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -145062,7 +145062,7 @@ stage: Modified - name: Modified946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1529\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1529\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -145071,7 +145071,7 @@ stage: Modified - name: Modified947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1530\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1530\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -145079,7 +145079,7 @@ stage: Modified - name: Modified948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1531\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1531\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -145087,7 +145087,7 @@ stage: Modified - name: Modified949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1532\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1532\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -145096,7 +145096,7 @@ stage: Modified - name: Modified950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1533\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816902,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1533\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816902, "attributes": @@ -145105,7 +145105,7 @@ stage: Modified - name: Modified951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1534\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1534\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -145113,7 +145113,7 @@ stage: Modified - name: Modified952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1535\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1535\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -145121,7 +145121,7 @@ stage: Modified - name: Modified953 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145144,7 +145144,7 @@ stage: Modified - name: Modified954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145154,7 +145154,7 @@ stage: Modified - name: Modified955 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145177,7 +145177,7 @@ stage: Modified - name: Modified956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145187,7 +145187,7 @@ stage: Modified - name: Modified957 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145210,7 +145210,7 @@ stage: Modified - name: Modified958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -145219,7 +145219,7 @@ stage: Modified - name: Modified959 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145242,7 +145242,7 @@ stage: Modified - name: Modified960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -145251,7 +145251,7 @@ stage: Modified - name: Modified961 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145274,7 +145274,7 @@ stage: Modified - name: Modified962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145283,7 +145283,7 @@ stage: Modified - name: Modified963 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145306,7 +145306,7 @@ stage: Modified - name: Modified964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145315,7 +145315,7 @@ stage: Modified - name: Modified965 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145338,7 +145338,7 @@ stage: Modified - name: Modified966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -145346,7 +145346,7 @@ stage: Modified - name: Modified967 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145369,7 +145369,7 @@ stage: Modified - name: Modified968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -145377,7 +145377,7 @@ stage: Modified - name: Modified969 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1544\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145400,7 +145400,7 @@ stage: Modified - name: Modified970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1544\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1544\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145410,7 +145410,7 @@ stage: Modified - name: Modified971 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1545\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145433,7 +145433,7 @@ stage: Modified - name: Modified972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1545\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1545\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145443,7 +145443,7 @@ stage: Modified - name: Modified973 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1546\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145466,7 +145466,7 @@ stage: Modified - name: Modified974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1546\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1546\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -145475,7 +145475,7 @@ stage: Modified - name: Modified975 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1547\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145498,7 +145498,7 @@ stage: Modified - name: Modified976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1547\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1547\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -145507,7 +145507,7 @@ stage: Modified - name: Modified977 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1548\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145530,7 +145530,7 @@ stage: Modified - name: Modified978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1548\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1548\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145539,7 +145539,7 @@ stage: Modified - name: Modified979 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1549\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145562,7 +145562,7 @@ stage: Modified - name: Modified980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1549\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1549\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145571,7 +145571,7 @@ stage: Modified - name: Modified981 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1550\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145594,7 +145594,7 @@ stage: Modified - name: Modified982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1550\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1550\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -145602,7 +145602,7 @@ stage: Modified - name: Modified983 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1551\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145625,7 +145625,7 @@ stage: Modified - name: Modified984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1551\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1551\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -145633,7 +145633,7 @@ stage: Modified - name: Modified985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145642,7 +145642,7 @@ stage: Modified - name: Modified986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145652,7 +145652,7 @@ stage: Modified - name: Modified987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145661,7 +145661,7 @@ stage: Modified - name: Modified988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145671,7 +145671,7 @@ stage: Modified - name: Modified989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145680,7 +145680,7 @@ stage: Modified - name: Modified990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -145689,7 +145689,7 @@ stage: Modified - name: Modified991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145698,7 +145698,7 @@ stage: Modified - name: Modified992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -145707,7 +145707,7 @@ stage: Modified - name: Modified993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145716,7 +145716,7 @@ stage: Modified - name: Modified994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145725,7 +145725,7 @@ stage: Modified - name: Modified995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145734,7 +145734,7 @@ stage: Modified - name: Modified996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145743,7 +145743,7 @@ stage: Modified - name: Modified997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145752,7 +145752,7 @@ stage: Modified - name: Modified998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -145760,7 +145760,7 @@ stage: Modified - name: Modified999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770016,"checksum":"29b5318d489320e08f636dcea9ff6a2cb38f2b78"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145769,7 +145769,7 @@ stage: Modified - name: Modified1000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -145777,7 +145777,7 @@ stage: Modified - name: Modified1001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145786,7 +145786,7 @@ stage: Modified - name: Modified1002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1560\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145796,7 +145796,7 @@ stage: Modified - name: Modified1003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145805,7 +145805,7 @@ stage: Modified - name: Modified1004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1561\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145815,7 +145815,7 @@ stage: Modified - name: Modified1005 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145824,7 +145824,7 @@ stage: Modified - name: Modified1006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1562\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -145833,7 +145833,7 @@ stage: Modified - name: Modified1007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145842,7 +145842,7 @@ stage: Modified - name: Modified1008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1563\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -145851,7 +145851,7 @@ stage: Modified - name: Modified1009 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145860,7 +145860,7 @@ stage: Modified - name: Modified1010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1564\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145869,7 +145869,7 @@ stage: Modified - name: Modified1011 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145878,7 +145878,7 @@ stage: Modified - name: Modified1012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1565\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145887,7 +145887,7 @@ stage: Modified - name: Modified1013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145896,7 +145896,7 @@ stage: Modified - name: Modified1014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1566\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -145904,7 +145904,7 @@ stage: Modified - name: Modified1015 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key", "arch": "[x64]", "timestamp": 1606816903, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -145913,7 +145913,7 @@ stage: Modified - name: Modified1016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1567\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -145921,7 +145921,7 @@ stage: Modified - name: Modified1017 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145943,7 +145943,7 @@ stage: Modified - name: Modified1018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145953,7 +145953,7 @@ stage: Modified - name: Modified1019 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816903,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -145975,7 +145975,7 @@ stage: Modified - name: Modified1020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816903,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816903, "attributes": @@ -145985,7 +145985,7 @@ stage: Modified - name: Modified1021 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146007,7 +146007,7 @@ stage: Modified - name: Modified1022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -146016,7 +146016,7 @@ stage: Modified - name: Modified1023 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146038,7 +146038,7 @@ stage: Modified - name: Modified1024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -146047,7 +146047,7 @@ stage: Modified - name: Modified1025 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146069,7 +146069,7 @@ stage: Modified - name: Modified1026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146078,7 +146078,7 @@ stage: Modified - name: Modified1027 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146100,7 +146100,7 @@ stage: Modified - name: Modified1028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146109,7 +146109,7 @@ stage: Modified - name: Modified1029 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146131,7 +146131,7 @@ stage: Modified - name: Modified1030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -146139,7 +146139,7 @@ stage: Modified - name: Modified1031 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146161,7 +146161,7 @@ stage: Modified - name: Modified1032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -146169,7 +146169,7 @@ stage: Modified - name: Modified1033 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1576\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146191,7 +146191,7 @@ stage: Modified - name: Modified1034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1576\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1576\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146201,7 +146201,7 @@ stage: Modified - name: Modified1035 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1577\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146223,7 +146223,7 @@ stage: Modified - name: Modified1036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1577\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1577\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146233,7 +146233,7 @@ stage: Modified - name: Modified1037 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1578\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146255,7 +146255,7 @@ stage: Modified - name: Modified1038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1578\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1578\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -146264,7 +146264,7 @@ stage: Modified - name: Modified1039 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1579\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146286,7 +146286,7 @@ stage: Modified - name: Modified1040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1579\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1579\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -146295,7 +146295,7 @@ stage: Modified - name: Modified1041 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1580\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146317,7 +146317,7 @@ stage: Modified - name: Modified1042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1580\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1580\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146326,7 +146326,7 @@ stage: Modified - name: Modified1043 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1581\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146348,7 +146348,7 @@ stage: Modified - name: Modified1044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1581\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1581\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146357,7 +146357,7 @@ stage: Modified - name: Modified1045 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1582\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146379,7 +146379,7 @@ stage: Modified - name: Modified1046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1582\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1582\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -146387,7 +146387,7 @@ stage: Modified - name: Modified1047 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1583\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146409,7 +146409,7 @@ stage: Modified - name: Modified1048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1583\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1583\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -146417,7 +146417,7 @@ stage: Modified - name: Modified1049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146425,7 +146425,7 @@ stage: Modified - name: Modified1050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146435,7 +146435,7 @@ stage: Modified - name: Modified1051 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146443,7 +146443,7 @@ stage: Modified - name: Modified1052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146453,7 +146453,7 @@ stage: Modified - name: Modified1053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146461,7 +146461,7 @@ stage: Modified - name: Modified1054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -146470,7 +146470,7 @@ stage: Modified - name: Modified1055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146478,7 +146478,7 @@ stage: Modified - name: Modified1056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -146487,7 +146487,7 @@ stage: Modified - name: Modified1057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146495,7 +146495,7 @@ stage: Modified - name: Modified1058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146504,7 +146504,7 @@ stage: Modified - name: Modified1059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146512,7 +146512,7 @@ stage: Modified - name: Modified1060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146521,7 +146521,7 @@ stage: Modified - name: Modified1061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146529,7 +146529,7 @@ stage: Modified - name: Modified1062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -146537,7 +146537,7 @@ stage: Modified - name: Modified1063 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770017,"checksum":"1951c8b79094d5959923379d90babd8116dc8462"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146545,7 +146545,7 @@ stage: Modified - name: Modified1064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -146553,7 +146553,7 @@ stage: Modified - name: Modified1065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146561,7 +146561,7 @@ stage: Modified - name: Modified1066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1592\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146571,7 +146571,7 @@ stage: Modified - name: Modified1067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146579,7 +146579,7 @@ stage: Modified - name: Modified1068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1593\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146589,7 +146589,7 @@ stage: Modified - name: Modified1069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146597,7 +146597,7 @@ stage: Modified - name: Modified1070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1594\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -146606,7 +146606,7 @@ stage: Modified - name: Modified1071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146614,7 +146614,7 @@ stage: Modified - name: Modified1072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1595\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -146623,7 +146623,7 @@ stage: Modified - name: Modified1073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146631,7 +146631,7 @@ stage: Modified - name: Modified1074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1596\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146640,7 +146640,7 @@ stage: Modified - name: Modified1075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146648,7 +146648,7 @@ stage: Modified - name: Modified1076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1597\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146657,7 +146657,7 @@ stage: Modified - name: Modified1077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146665,7 +146665,7 @@ stage: Modified - name: Modified1078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1598\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -146673,7 +146673,7 @@ stage: Modified - name: Modified1079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key", "arch": "[x64]", "timestamp": 1606816904, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -146681,7 +146681,7 @@ stage: Modified - name: Modified1080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1599\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -146689,7 +146689,7 @@ stage: Modified - name: Modified1081 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146711,7 +146711,7 @@ stage: Modified - name: Modified1082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146721,7 +146721,7 @@ stage: Modified - name: Modified1083 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146743,7 +146743,7 @@ stage: Modified - name: Modified1084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146753,7 +146753,7 @@ stage: Modified - name: Modified1085 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146775,7 +146775,7 @@ stage: Modified - name: Modified1086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -146784,7 +146784,7 @@ stage: Modified - name: Modified1087 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146806,7 +146806,7 @@ stage: Modified - name: Modified1088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -146815,7 +146815,7 @@ stage: Modified - name: Modified1089 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816904,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146837,7 +146837,7 @@ stage: Modified - name: Modified1090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816904,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816904, "attributes": @@ -146846,7 +146846,7 @@ stage: Modified - name: Modified1091 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146868,7 +146868,7 @@ stage: Modified - name: Modified1092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -146877,7 +146877,7 @@ stage: Modified - name: Modified1093 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146899,7 +146899,7 @@ stage: Modified - name: Modified1094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -146907,7 +146907,7 @@ stage: Modified - name: Modified1095 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146929,7 +146929,7 @@ stage: Modified - name: Modified1096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -146937,7 +146937,7 @@ stage: Modified - name: Modified1097 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1608\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146959,7 +146959,7 @@ stage: Modified - name: Modified1098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1608\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1608\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -146969,7 +146969,7 @@ stage: Modified - name: Modified1099 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1609\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -146991,7 +146991,7 @@ stage: Modified - name: Modified1100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1609\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1609\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147001,7 +147001,7 @@ stage: Modified - name: Modified1101 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1610\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147023,7 +147023,7 @@ stage: Modified - name: Modified1102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1610\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1610\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147032,7 +147032,7 @@ stage: Modified - name: Modified1103 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1611\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147054,7 +147054,7 @@ stage: Modified - name: Modified1104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1611\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1611\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147063,7 +147063,7 @@ stage: Modified - name: Modified1105 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1612\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147085,7 +147085,7 @@ stage: Modified - name: Modified1106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1612\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1612\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147094,7 +147094,7 @@ stage: Modified - name: Modified1107 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1613\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147116,7 +147116,7 @@ stage: Modified - name: Modified1108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1613\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1613\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147125,7 +147125,7 @@ stage: Modified - name: Modified1109 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1614\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147147,7 +147147,7 @@ stage: Modified - name: Modified1110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1614\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1614\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -147155,7 +147155,7 @@ stage: Modified - name: Modified1111 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1615\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147177,7 +147177,7 @@ stage: Modified - name: Modified1112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1615\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1615\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -147185,7 +147185,7 @@ stage: Modified - name: Modified1113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key", "arch": "[x64]", "timestamp": 1606816905, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -147193,7 +147193,7 @@ stage: Modified - name: Modified1114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147203,7 +147203,7 @@ stage: Modified - name: Modified1115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key", "arch": "[x64]", "timestamp": 1606816905, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -147211,7 +147211,7 @@ stage: Modified - name: Modified1116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147221,7 +147221,7 @@ stage: Modified - name: Modified1117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key", "arch": "[x64]", "timestamp": 1606816905, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -147229,7 +147229,7 @@ stage: Modified - name: Modified1118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147238,7 +147238,7 @@ stage: Modified - name: Modified1119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key", "arch": "[x64]", "timestamp": 1606816905, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -147246,7 +147246,7 @@ stage: Modified - name: Modified1120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147255,7 +147255,7 @@ stage: Modified - name: Modified1121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key", "arch": "[x64]", "timestamp": 1606816905, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -147263,7 +147263,7 @@ stage: Modified - name: Modified1122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147272,7 +147272,7 @@ stage: Modified - name: Modified1123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key", "arch": "[x64]", "timestamp": 1606816905, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -147280,7 +147280,7 @@ stage: Modified - name: Modified1124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147289,7 +147289,7 @@ stage: Modified - name: Modified1125 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key", "arch": "[x64]", "timestamp": 1606816905, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -147297,7 +147297,7 @@ stage: Modified - name: Modified1126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -147305,7 +147305,7 @@ stage: Modified - name: Modified1127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770018,"checksum":"7071c1acd8aaadf0e975bca54707996263b89f07"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key", "arch": "[x64]", "timestamp": 1606816905, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -147313,7 +147313,7 @@ stage: Modified - name: Modified1128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -147321,7 +147321,7 @@ stage: Modified - name: Modified1129 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1624\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1624\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147331,7 +147331,7 @@ stage: Modified - name: Modified1130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1625\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1625\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147341,7 +147341,7 @@ stage: Modified - name: Modified1131 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1626\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1626\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147350,7 +147350,7 @@ stage: Modified - name: Modified1132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1627\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1627\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147359,7 +147359,7 @@ stage: Modified - name: Modified1133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1628\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1628\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147368,7 +147368,7 @@ stage: Modified - name: Modified1134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1629\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1629\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147377,7 +147377,7 @@ stage: Modified - name: Modified1135 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1630\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1630\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -147385,7 +147385,7 @@ stage: Modified - name: Modified1136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1631\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1631\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -147393,7 +147393,7 @@ stage: Modified - name: Modified1137 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147414,7 +147414,7 @@ stage: Modified - name: Modified1138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147424,7 +147424,7 @@ stage: Modified - name: Modified1139 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147445,7 +147445,7 @@ stage: Modified - name: Modified1140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147455,7 +147455,7 @@ stage: Modified - name: Modified1141 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147476,7 +147476,7 @@ stage: Modified - name: Modified1142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147485,7 +147485,7 @@ stage: Modified - name: Modified1143 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147506,7 +147506,7 @@ stage: Modified - name: Modified1144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147515,7 +147515,7 @@ stage: Modified - name: Modified1145 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147536,7 +147536,7 @@ stage: Modified - name: Modified1146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147545,7 +147545,7 @@ stage: Modified - name: Modified1147 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147566,7 +147566,7 @@ stage: Modified - name: Modified1148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147575,7 +147575,7 @@ stage: Modified - name: Modified1149 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147596,7 +147596,7 @@ stage: Modified - name: Modified1150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -147604,7 +147604,7 @@ stage: Modified - name: Modified1151 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147625,7 +147625,7 @@ stage: Modified - name: Modified1152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -147633,7 +147633,7 @@ stage: Modified - name: Modified1153 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1640\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816905,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147654,7 +147654,7 @@ stage: Modified - name: Modified1154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1640\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816905,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1640\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816905, "attributes": @@ -147664,7 +147664,7 @@ stage: Modified - name: Modified1155 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1641\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147685,7 +147685,7 @@ stage: Modified - name: Modified1156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1641\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1641\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -147695,7 +147695,7 @@ stage: Modified - name: Modified1157 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1642\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147716,7 +147716,7 @@ stage: Modified - name: Modified1158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1642\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1642\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147725,7 +147725,7 @@ stage: Modified - name: Modified1159 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1643\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147746,7 +147746,7 @@ stage: Modified - name: Modified1160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1643\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1643\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147755,7 +147755,7 @@ stage: Modified - name: Modified1161 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1644\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147776,7 +147776,7 @@ stage: Modified - name: Modified1162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1644\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1644\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -147785,7 +147785,7 @@ stage: Modified - name: Modified1163 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1645\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147806,7 +147806,7 @@ stage: Modified - name: Modified1164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1645\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1645\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -147815,7 +147815,7 @@ stage: Modified - name: Modified1165 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1646\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147836,7 +147836,7 @@ stage: Modified - name: Modified1166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1646\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1646\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -147844,7 +147844,7 @@ stage: Modified - name: Modified1167 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1647\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -147865,7 +147865,7 @@ stage: Modified - name: Modified1168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1647\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1647\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -147873,14 +147873,14 @@ stage: Modified - name: Modified1169 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770018,"checksum":"e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770018,"checksum":"e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key", "arch": "[x64]", "timestamp": 1606816906, "attributes": {"type": "registry_key", "mtime": 1606770018, "checksum": "e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"}}' stage: Modified - name: Modified1170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -147890,14 +147890,14 @@ stage: Modified - name: Modified1171 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770018,"checksum":"e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770018,"checksum":"e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key", "arch": "[x64]", "timestamp": 1606816906, "attributes": {"type": "registry_key", "mtime": 1606770018, "checksum": "e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"}}' stage: Modified - name: Modified1172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -147907,14 +147907,14 @@ stage: Modified - name: Modified1173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770018,"checksum":"e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770018,"checksum":"e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key", "arch": "[x64]", "timestamp": 1606816906, "attributes": {"type": "registry_key", "mtime": 1606770018, "checksum": "e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"}}' stage: Modified - name: Modified1174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147923,14 +147923,14 @@ stage: Modified - name: Modified1175 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770018,"checksum":"e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770018,"checksum":"e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key", "arch": "[x64]", "timestamp": 1606816906, "attributes": {"type": "registry_key", "mtime": 1606770018, "checksum": "e38c2a8c063fa576e04ce60e6f8aecf6ad31c34c"}}' stage: Modified - name: Modified1176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -147939,14 +147939,14 @@ stage: Modified - name: Modified1177 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770019,"checksum":"eb17bf38be5017aa3d32aba388925804d25779f8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770019,"checksum":"eb17bf38be5017aa3d32aba388925804d25779f8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key", "arch": "[x64]", "timestamp": 1606816906, "attributes": {"type": "registry_key", "mtime": 1606770019, "checksum": "eb17bf38be5017aa3d32aba388925804d25779f8"}}' stage: Modified - name: Modified1178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -147955,14 +147955,14 @@ stage: Modified - name: Modified1179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770019,"checksum":"eb17bf38be5017aa3d32aba388925804d25779f8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770019,"checksum":"eb17bf38be5017aa3d32aba388925804d25779f8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key", "arch": "[x64]", "timestamp": 1606816906, "attributes": {"type": "registry_key", "mtime": 1606770019, "checksum": "eb17bf38be5017aa3d32aba388925804d25779f8"}}' stage: Modified - name: Modified1180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -147971,14 +147971,14 @@ stage: Modified - name: Modified1181 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770019,"checksum":"eb17bf38be5017aa3d32aba388925804d25779f8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770019,"checksum":"eb17bf38be5017aa3d32aba388925804d25779f8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key", "arch": "[x64]", "timestamp": 1606816906, "attributes": {"type": "registry_key", "mtime": 1606770019, "checksum": "eb17bf38be5017aa3d32aba388925804d25779f8"}}' stage: Modified - name: Modified1182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -147986,14 +147986,14 @@ stage: Modified - name: Modified1183 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770019,"checksum":"eb17bf38be5017aa3d32aba388925804d25779f8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","mtime":1606770019,"checksum":"eb17bf38be5017aa3d32aba388925804d25779f8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key", "arch": "[x64]", "timestamp": 1606816906, "attributes": {"type": "registry_key", "mtime": 1606770019, "checksum": "eb17bf38be5017aa3d32aba388925804d25779f8"}}' stage: Modified - name: Modified1184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148001,7 +148001,7 @@ stage: Modified - name: Modified1185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1656\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1656\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -148011,7 +148011,7 @@ stage: Modified - name: Modified1186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1657\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1657\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -148021,7 +148021,7 @@ stage: Modified - name: Modified1187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1658\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1658\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -148030,7 +148030,7 @@ stage: Modified - name: Modified1188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1659\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1659\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -148039,7 +148039,7 @@ stage: Modified - name: Modified1189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1660\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1660\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -148048,7 +148048,7 @@ stage: Modified - name: Modified1190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1661\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1661\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -148057,7 +148057,7 @@ stage: Modified - name: Modified1191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1662\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1662\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148065,7 +148065,7 @@ stage: Modified - name: Modified1192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1663\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1663\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148073,7 +148073,7 @@ stage: Modified - name: Modified1193 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148096,7 +148096,7 @@ stage: Modified - name: Modified1194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -148105,7 +148105,7 @@ stage: Modified - name: Modified1195 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148128,7 +148128,7 @@ stage: Modified - name: Modified1196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -148137,7 +148137,7 @@ stage: Modified - name: Modified1197 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148160,7 +148160,7 @@ stage: Modified - name: Modified1198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148168,7 +148168,7 @@ stage: Modified - name: Modified1199 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148191,7 +148191,7 @@ stage: Modified - name: Modified1200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148199,7 +148199,7 @@ stage: Modified - name: Modified1201 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148222,7 +148222,7 @@ stage: Modified - name: Modified1202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -148231,7 +148231,7 @@ stage: Modified - name: Modified1203 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148254,7 +148254,7 @@ stage: Modified - name: Modified1204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -148263,7 +148263,7 @@ stage: Modified - name: Modified1205 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148286,7 +148286,7 @@ stage: Modified - name: Modified1206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148294,7 +148294,7 @@ stage: Modified - name: Modified1207 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148317,7 +148317,7 @@ stage: Modified - name: Modified1208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148325,7 +148325,7 @@ stage: Modified - name: Modified1209 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1672\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148348,7 +148348,7 @@ stage: Modified - name: Modified1210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1672\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1672\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -148357,7 +148357,7 @@ stage: Modified - name: Modified1211 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1673\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148380,7 +148380,7 @@ stage: Modified - name: Modified1212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1673\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1673\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -148389,7 +148389,7 @@ stage: Modified - name: Modified1213 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1674\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148412,7 +148412,7 @@ stage: Modified - name: Modified1214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1674\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1674\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148420,7 +148420,7 @@ stage: Modified - name: Modified1215 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1675\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148443,7 +148443,7 @@ stage: Modified - name: Modified1216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1675\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1675\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148451,7 +148451,7 @@ stage: Modified - name: Modified1217 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1676\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816906,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148474,7 +148474,7 @@ stage: Modified - name: Modified1218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1676\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816906,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1676\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816906, "attributes": @@ -148483,7 +148483,7 @@ stage: Modified - name: Modified1219 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1677\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148506,7 +148506,7 @@ stage: Modified - name: Modified1220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1677\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1677\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -148515,7 +148515,7 @@ stage: Modified - name: Modified1221 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1678\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148538,7 +148538,7 @@ stage: Modified - name: Modified1222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1678\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1678\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148546,7 +148546,7 @@ stage: Modified - name: Modified1223 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1679\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148569,7 +148569,7 @@ stage: Modified - name: Modified1224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1679\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1679\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148577,7 +148577,7 @@ stage: Modified - name: Modified1225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148586,7 +148586,7 @@ stage: Modified - name: Modified1226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -148595,7 +148595,7 @@ stage: Modified - name: Modified1227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148604,7 +148604,7 @@ stage: Modified - name: Modified1228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -148613,7 +148613,7 @@ stage: Modified - name: Modified1229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148622,7 +148622,7 @@ stage: Modified - name: Modified1230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148630,7 +148630,7 @@ stage: Modified - name: Modified1231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148639,7 +148639,7 @@ stage: Modified - name: Modified1232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148647,7 +148647,7 @@ stage: Modified - name: Modified1233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148656,7 +148656,7 @@ stage: Modified - name: Modified1234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -148665,7 +148665,7 @@ stage: Modified - name: Modified1235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148674,7 +148674,7 @@ stage: Modified - name: Modified1236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -148683,7 +148683,7 @@ stage: Modified - name: Modified1237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148692,7 +148692,7 @@ stage: Modified - name: Modified1238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148700,7 +148700,7 @@ stage: Modified - name: Modified1239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770019,"checksum":"c8aeca1828028bf70ea4737e3d480932b70d9564"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148709,7 +148709,7 @@ stage: Modified - name: Modified1240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148717,7 +148717,7 @@ stage: Modified - name: Modified1241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148726,7 +148726,7 @@ stage: Modified - name: Modified1242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1688\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -148735,7 +148735,7 @@ stage: Modified - name: Modified1243 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148744,7 +148744,7 @@ stage: Modified - name: Modified1244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1689\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -148753,7 +148753,7 @@ stage: Modified - name: Modified1245 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148762,7 +148762,7 @@ stage: Modified - name: Modified1246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1690\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148770,7 +148770,7 @@ stage: Modified - name: Modified1247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148779,7 +148779,7 @@ stage: Modified - name: Modified1248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1691\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148787,7 +148787,7 @@ stage: Modified - name: Modified1249 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148796,7 +148796,7 @@ stage: Modified - name: Modified1250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1692\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -148805,7 +148805,7 @@ stage: Modified - name: Modified1251 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148814,7 +148814,7 @@ stage: Modified - name: Modified1252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1693\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -148823,7 +148823,7 @@ stage: Modified - name: Modified1253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148832,7 +148832,7 @@ stage: Modified - name: Modified1254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1694\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148840,7 +148840,7 @@ stage: Modified - name: Modified1255 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -148849,7 +148849,7 @@ stage: Modified - name: Modified1256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1695\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148857,7 +148857,7 @@ stage: Modified - name: Modified1257 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148879,7 +148879,7 @@ stage: Modified - name: Modified1258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -148888,7 +148888,7 @@ stage: Modified - name: Modified1259 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148910,7 +148910,7 @@ stage: Modified - name: Modified1260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -148919,7 +148919,7 @@ stage: Modified - name: Modified1261 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148941,7 +148941,7 @@ stage: Modified - name: Modified1262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148949,7 +148949,7 @@ stage: Modified - name: Modified1263 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -148971,7 +148971,7 @@ stage: Modified - name: Modified1264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -148979,7 +148979,7 @@ stage: Modified - name: Modified1265 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149001,7 +149001,7 @@ stage: Modified - name: Modified1266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -149010,7 +149010,7 @@ stage: Modified - name: Modified1267 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149032,7 +149032,7 @@ stage: Modified - name: Modified1268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -149041,7 +149041,7 @@ stage: Modified - name: Modified1269 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149063,7 +149063,7 @@ stage: Modified - name: Modified1270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149071,7 +149071,7 @@ stage: Modified - name: Modified1271 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149093,7 +149093,7 @@ stage: Modified - name: Modified1272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149101,7 +149101,7 @@ stage: Modified - name: Modified1273 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1704\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149123,7 +149123,7 @@ stage: Modified - name: Modified1274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1704\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1704\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -149132,7 +149132,7 @@ stage: Modified - name: Modified1275 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1705\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149154,7 +149154,7 @@ stage: Modified - name: Modified1276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1705\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1705\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -149163,7 +149163,7 @@ stage: Modified - name: Modified1277 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1706\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149185,7 +149185,7 @@ stage: Modified - name: Modified1278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1706\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1706\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149193,7 +149193,7 @@ stage: Modified - name: Modified1279 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1707\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149215,7 +149215,7 @@ stage: Modified - name: Modified1280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1707\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1707\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149223,7 +149223,7 @@ stage: Modified - name: Modified1281 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1708\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149245,7 +149245,7 @@ stage: Modified - name: Modified1282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1708\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1708\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -149254,7 +149254,7 @@ stage: Modified - name: Modified1283 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1709\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149276,7 +149276,7 @@ stage: Modified - name: Modified1284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1709\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1709\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -149285,7 +149285,7 @@ stage: Modified - name: Modified1285 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1710\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149307,7 +149307,7 @@ stage: Modified - name: Modified1286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1710\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1710\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149315,7 +149315,7 @@ stage: Modified - name: Modified1287 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1711\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149337,7 +149337,7 @@ stage: Modified - name: Modified1288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1711\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1711\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149345,7 +149345,7 @@ stage: Modified - name: Modified1289 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816907,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key", "arch": "[x64]", "timestamp": 1606816907, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149353,7 +149353,7 @@ stage: Modified - name: Modified1290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816907,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816907, "attributes": @@ -149362,7 +149362,7 @@ stage: Modified - name: Modified1291 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149370,7 +149370,7 @@ stage: Modified - name: Modified1292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149379,7 +149379,7 @@ stage: Modified - name: Modified1293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149387,7 +149387,7 @@ stage: Modified - name: Modified1294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149395,7 +149395,7 @@ stage: Modified - name: Modified1295 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149403,7 +149403,7 @@ stage: Modified - name: Modified1296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149411,7 +149411,7 @@ stage: Modified - name: Modified1297 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149419,7 +149419,7 @@ stage: Modified - name: Modified1298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149428,7 +149428,7 @@ stage: Modified - name: Modified1299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149436,7 +149436,7 @@ stage: Modified - name: Modified1300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149445,7 +149445,7 @@ stage: Modified - name: Modified1301 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149453,7 +149453,7 @@ stage: Modified - name: Modified1302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149461,7 +149461,7 @@ stage: Modified - name: Modified1303 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770020,"checksum":"c1ea913582f586715a8ff825aaba064bc1ca63f1"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149469,7 +149469,7 @@ stage: Modified - name: Modified1304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149477,7 +149477,7 @@ stage: Modified - name: Modified1305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149485,7 +149485,7 @@ stage: Modified - name: Modified1306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1720\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149494,7 +149494,7 @@ stage: Modified - name: Modified1307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149502,7 +149502,7 @@ stage: Modified - name: Modified1308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1721\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149511,7 +149511,7 @@ stage: Modified - name: Modified1309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149519,7 +149519,7 @@ stage: Modified - name: Modified1310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1722\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149527,7 +149527,7 @@ stage: Modified - name: Modified1311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149535,7 +149535,7 @@ stage: Modified - name: Modified1312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1723\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149543,7 +149543,7 @@ stage: Modified - name: Modified1313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149551,7 +149551,7 @@ stage: Modified - name: Modified1314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1724\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149560,7 +149560,7 @@ stage: Modified - name: Modified1315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149568,7 +149568,7 @@ stage: Modified - name: Modified1316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1725\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149577,7 +149577,7 @@ stage: Modified - name: Modified1317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149585,7 +149585,7 @@ stage: Modified - name: Modified1318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1726\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149593,7 +149593,7 @@ stage: Modified - name: Modified1319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -149601,7 +149601,7 @@ stage: Modified - name: Modified1320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1727\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149609,7 +149609,7 @@ stage: Modified - name: Modified1321 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149631,7 +149631,7 @@ stage: Modified - name: Modified1322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149640,7 +149640,7 @@ stage: Modified - name: Modified1323 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149662,7 +149662,7 @@ stage: Modified - name: Modified1324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149671,7 +149671,7 @@ stage: Modified - name: Modified1325 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149693,7 +149693,7 @@ stage: Modified - name: Modified1326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149701,7 +149701,7 @@ stage: Modified - name: Modified1327 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149723,7 +149723,7 @@ stage: Modified - name: Modified1328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149731,7 +149731,7 @@ stage: Modified - name: Modified1329 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149753,7 +149753,7 @@ stage: Modified - name: Modified1330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149762,7 +149762,7 @@ stage: Modified - name: Modified1331 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149784,7 +149784,7 @@ stage: Modified - name: Modified1332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149793,7 +149793,7 @@ stage: Modified - name: Modified1333 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149815,7 +149815,7 @@ stage: Modified - name: Modified1334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149823,7 +149823,7 @@ stage: Modified - name: Modified1335 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149845,7 +149845,7 @@ stage: Modified - name: Modified1336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149853,7 +149853,7 @@ stage: Modified - name: Modified1337 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1736\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149875,7 +149875,7 @@ stage: Modified - name: Modified1338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1736\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1736\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149884,7 +149884,7 @@ stage: Modified - name: Modified1339 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1737\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149906,7 +149906,7 @@ stage: Modified - name: Modified1340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1737\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1737\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -149915,7 +149915,7 @@ stage: Modified - name: Modified1341 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1738\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149937,7 +149937,7 @@ stage: Modified - name: Modified1342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1738\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1738\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149945,7 +149945,7 @@ stage: Modified - name: Modified1343 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1739\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149967,7 +149967,7 @@ stage: Modified - name: Modified1344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1739\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1739\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -149975,7 +149975,7 @@ stage: Modified - name: Modified1345 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1740\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -149997,7 +149997,7 @@ stage: Modified - name: Modified1346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1740\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1740\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -150006,7 +150006,7 @@ stage: Modified - name: Modified1347 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1741\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150028,7 +150028,7 @@ stage: Modified - name: Modified1348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1741\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1741\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -150037,7 +150037,7 @@ stage: Modified - name: Modified1349 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1742\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150059,7 +150059,7 @@ stage: Modified - name: Modified1350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1742\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1742\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150067,7 +150067,7 @@ stage: Modified - name: Modified1351 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1743\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150089,7 +150089,7 @@ stage: Modified - name: Modified1352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1743\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1743\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150097,7 +150097,7 @@ stage: Modified - name: Modified1353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -150105,7 +150105,7 @@ stage: Modified - name: Modified1354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -150114,7 +150114,7 @@ stage: Modified - name: Modified1355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -150122,7 +150122,7 @@ stage: Modified - name: Modified1356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -150131,7 +150131,7 @@ stage: Modified - name: Modified1357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -150139,7 +150139,7 @@ stage: Modified - name: Modified1358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150147,7 +150147,7 @@ stage: Modified - name: Modified1359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -150155,7 +150155,7 @@ stage: Modified - name: Modified1360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150163,7 +150163,7 @@ stage: Modified - name: Modified1361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -150171,7 +150171,7 @@ stage: Modified - name: Modified1362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -150180,7 +150180,7 @@ stage: Modified - name: Modified1363 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816908,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key", "arch": "[x64]", "timestamp": 1606816908, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -150188,7 +150188,7 @@ stage: Modified - name: Modified1364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816908,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816908, "attributes": @@ -150197,7 +150197,7 @@ stage: Modified - name: Modified1365 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key", "arch": "[x64]", "timestamp": 1606816909, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -150205,7 +150205,7 @@ stage: Modified - name: Modified1366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150213,7 +150213,7 @@ stage: Modified - name: Modified1367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770020,"checksum":"2fafe5edc1aa1fcd7581efe840a447697e800e9f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key", "arch": "[x64]", "timestamp": 1606816909, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -150221,7 +150221,7 @@ stage: Modified - name: Modified1368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150229,7 +150229,7 @@ stage: Modified - name: Modified1369 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1752\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1752\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150238,7 +150238,7 @@ stage: Modified - name: Modified1370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1753\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1753\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150247,7 +150247,7 @@ stage: Modified - name: Modified1371 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1754\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1754\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150255,7 +150255,7 @@ stage: Modified - name: Modified1372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1755\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1755\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150263,7 +150263,7 @@ stage: Modified - name: Modified1373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1756\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1756\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150272,7 +150272,7 @@ stage: Modified - name: Modified1374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1757\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1757\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150281,7 +150281,7 @@ stage: Modified - name: Modified1375 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1758\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1758\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150289,7 +150289,7 @@ stage: Modified - name: Modified1376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1759\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1759\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150297,7 +150297,7 @@ stage: Modified - name: Modified1377 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150318,7 +150318,7 @@ stage: Modified - name: Modified1378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150327,7 +150327,7 @@ stage: Modified - name: Modified1379 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150348,7 +150348,7 @@ stage: Modified - name: Modified1380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150357,7 +150357,7 @@ stage: Modified - name: Modified1381 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150378,7 +150378,7 @@ stage: Modified - name: Modified1382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150386,7 +150386,7 @@ stage: Modified - name: Modified1383 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150407,7 +150407,7 @@ stage: Modified - name: Modified1384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150415,7 +150415,7 @@ stage: Modified - name: Modified1385 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150436,7 +150436,7 @@ stage: Modified - name: Modified1386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150445,7 +150445,7 @@ stage: Modified - name: Modified1387 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150466,7 +150466,7 @@ stage: Modified - name: Modified1388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150475,7 +150475,7 @@ stage: Modified - name: Modified1389 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150496,7 +150496,7 @@ stage: Modified - name: Modified1390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150504,7 +150504,7 @@ stage: Modified - name: Modified1391 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150525,7 +150525,7 @@ stage: Modified - name: Modified1392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150533,7 +150533,7 @@ stage: Modified - name: Modified1393 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1768\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150554,7 +150554,7 @@ stage: Modified - name: Modified1394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1768\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1768\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150563,7 +150563,7 @@ stage: Modified - name: Modified1395 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1769\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150584,7 +150584,7 @@ stage: Modified - name: Modified1396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1769\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1769\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150593,7 +150593,7 @@ stage: Modified - name: Modified1397 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1770\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150614,7 +150614,7 @@ stage: Modified - name: Modified1398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1770\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1770\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150622,7 +150622,7 @@ stage: Modified - name: Modified1399 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1771\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150643,7 +150643,7 @@ stage: Modified - name: Modified1400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1771\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1771\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150651,7 +150651,7 @@ stage: Modified - name: Modified1401 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1772\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150672,7 +150672,7 @@ stage: Modified - name: Modified1402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1772\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1772\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150681,7 +150681,7 @@ stage: Modified - name: Modified1403 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1773\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150702,7 +150702,7 @@ stage: Modified - name: Modified1404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1773\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1773\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150711,7 +150711,7 @@ stage: Modified - name: Modified1405 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1774\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150732,7 +150732,7 @@ stage: Modified - name: Modified1406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1774\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1774\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150740,7 +150740,7 @@ stage: Modified - name: Modified1407 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1775\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150761,7 +150761,7 @@ stage: Modified - name: Modified1408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1775\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1775\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150769,14 +150769,14 @@ stage: Modified - name: Modified1409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key", "arch": "[x64]", "timestamp": 1606816909, "attributes": {"type": "registry_key", "mtime": 1606770021, "checksum": "a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"}}' stage: Modified - name: Modified1410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150785,14 +150785,14 @@ stage: Modified - name: Modified1411 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key", "arch": "[x64]", "timestamp": 1606816909, "attributes": {"type": "registry_key", "mtime": 1606770021, "checksum": "a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"}}' stage: Modified - name: Modified1412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150801,14 +150801,14 @@ stage: Modified - name: Modified1413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key", "arch": "[x64]", "timestamp": 1606816909, "attributes": {"type": "registry_key", "mtime": 1606770021, "checksum": "a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"}}' stage: Modified - name: Modified1414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150816,14 +150816,14 @@ stage: Modified - name: Modified1415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key", "arch": "[x64]", "timestamp": 1606816909, "attributes": {"type": "registry_key", "mtime": 1606770021, "checksum": "a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"}}' stage: Modified - name: Modified1416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150831,14 +150831,14 @@ stage: Modified - name: Modified1417 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key", "arch": "[x64]", "timestamp": 1606816909, "attributes": {"type": "registry_key", "mtime": 1606770021, "checksum": "a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"}}' stage: Modified - name: Modified1418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150847,14 +150847,14 @@ stage: Modified - name: Modified1419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key", "arch": "[x64]", "timestamp": 1606816909, "attributes": {"type": "registry_key", "mtime": 1606770021, "checksum": "a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"}}' stage: Modified - name: Modified1420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150863,14 +150863,14 @@ stage: Modified - name: Modified1421 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key", "arch": "[x64]", "timestamp": 1606816909, "attributes": {"type": "registry_key", "mtime": 1606770021, "checksum": "a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"}}' stage: Modified - name: Modified1422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150878,14 +150878,14 @@ stage: Modified - name: Modified1423 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816909,"attributes":{"type":"registry_key","mtime":1606770021,"checksum":"a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key", "arch": "[x64]", "timestamp": 1606816909, "attributes": {"type": "registry_key", "mtime": 1606770021, "checksum": "a64b4bff3ae9a7b9249fd1bf96e34fd7a17e36e9"}}' stage: Modified - name: Modified1424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150893,7 +150893,7 @@ stage: Modified - name: Modified1425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1784\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1784\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150902,7 +150902,7 @@ stage: Modified - name: Modified1426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1785\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816909,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1785\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816909, "attributes": @@ -150911,7 +150911,7 @@ stage: Modified - name: Modified1427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1786\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1786\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150919,7 +150919,7 @@ stage: Modified - name: Modified1428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1787\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1787\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150927,7 +150927,7 @@ stage: Modified - name: Modified1429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1788\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1788\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -150936,7 +150936,7 @@ stage: Modified - name: Modified1430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1789\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1789\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -150945,7 +150945,7 @@ stage: Modified - name: Modified1431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1790\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1790\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150953,7 +150953,7 @@ stage: Modified - name: Modified1432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1791\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1791\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -150961,7 +150961,7 @@ stage: Modified - name: Modified1433 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -150984,7 +150984,7 @@ stage: Modified - name: Modified1434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -150992,7 +150992,7 @@ stage: Modified - name: Modified1435 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151015,7 +151015,7 @@ stage: Modified - name: Modified1436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151023,7 +151023,7 @@ stage: Modified - name: Modified1437 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151046,14 +151046,14 @@ stage: Modified - name: Modified1438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1439 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151076,14 +151076,14 @@ stage: Modified - name: Modified1440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1441 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151106,7 +151106,7 @@ stage: Modified - name: Modified1442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151114,7 +151114,7 @@ stage: Modified - name: Modified1443 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151137,7 +151137,7 @@ stage: Modified - name: Modified1444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151145,7 +151145,7 @@ stage: Modified - name: Modified1445 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151168,14 +151168,14 @@ stage: Modified - name: Modified1446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1447 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151198,14 +151198,14 @@ stage: Modified - name: Modified1448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1449 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1800\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151228,7 +151228,7 @@ stage: Modified - name: Modified1450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1800\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1800\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151236,7 +151236,7 @@ stage: Modified - name: Modified1451 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1801\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151259,7 +151259,7 @@ stage: Modified - name: Modified1452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1801\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1801\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151267,7 +151267,7 @@ stage: Modified - name: Modified1453 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1802\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151290,14 +151290,14 @@ stage: Modified - name: Modified1454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1802\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1802\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1455 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1803\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151320,14 +151320,14 @@ stage: Modified - name: Modified1456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1803\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1803\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1457 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1804\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151350,7 +151350,7 @@ stage: Modified - name: Modified1458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1804\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1804\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151358,7 +151358,7 @@ stage: Modified - name: Modified1459 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1805\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151381,7 +151381,7 @@ stage: Modified - name: Modified1460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1805\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1805\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151389,7 +151389,7 @@ stage: Modified - name: Modified1461 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1806\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151412,14 +151412,14 @@ stage: Modified - name: Modified1462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1806\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1806\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1463 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1807\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151442,14 +151442,14 @@ stage: Modified - name: Modified1464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1807\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1807\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151458,7 +151458,7 @@ stage: Modified - name: Modified1466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151466,7 +151466,7 @@ stage: Modified - name: Modified1467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151475,7 +151475,7 @@ stage: Modified - name: Modified1468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151483,7 +151483,7 @@ stage: Modified - name: Modified1469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151492,14 +151492,14 @@ stage: Modified - name: Modified1470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151508,14 +151508,14 @@ stage: Modified - name: Modified1472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151524,7 +151524,7 @@ stage: Modified - name: Modified1474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151532,7 +151532,7 @@ stage: Modified - name: Modified1475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151541,7 +151541,7 @@ stage: Modified - name: Modified1476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151549,7 +151549,7 @@ stage: Modified - name: Modified1477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151558,14 +151558,14 @@ stage: Modified - name: Modified1478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770021,"checksum":"3188067f04f03a2be56e41b66073d4120c3fafc7"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151574,14 +151574,14 @@ stage: Modified - name: Modified1480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151590,7 +151590,7 @@ stage: Modified - name: Modified1482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1816\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151598,7 +151598,7 @@ stage: Modified - name: Modified1483 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151607,7 +151607,7 @@ stage: Modified - name: Modified1484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1817\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151615,7 +151615,7 @@ stage: Modified - name: Modified1485 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151624,14 +151624,14 @@ stage: Modified - name: Modified1486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1818\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151640,14 +151640,14 @@ stage: Modified - name: Modified1488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1819\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1489 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151656,7 +151656,7 @@ stage: Modified - name: Modified1490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1820\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151664,7 +151664,7 @@ stage: Modified - name: Modified1491 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151673,7 +151673,7 @@ stage: Modified - name: Modified1492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1821\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151681,7 +151681,7 @@ stage: Modified - name: Modified1493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151690,14 +151690,14 @@ stage: Modified - name: Modified1494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1822\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1495 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key", "arch": "[x64]", "timestamp": 1606816910, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -151706,14 +151706,14 @@ stage: Modified - name: Modified1496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1823\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1497 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816910,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151735,7 +151735,7 @@ stage: Modified - name: Modified1498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816910,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816910, "attributes": @@ -151743,7 +151743,7 @@ stage: Modified - name: Modified1499 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151765,7 +151765,7 @@ stage: Modified - name: Modified1500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -151773,7 +151773,7 @@ stage: Modified - name: Modified1501 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151795,14 +151795,14 @@ stage: Modified - name: Modified1502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1503 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151824,14 +151824,14 @@ stage: Modified - name: Modified1504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1505 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151853,7 +151853,7 @@ stage: Modified - name: Modified1506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -151861,7 +151861,7 @@ stage: Modified - name: Modified1507 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151883,7 +151883,7 @@ stage: Modified - name: Modified1508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -151891,7 +151891,7 @@ stage: Modified - name: Modified1509 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151913,14 +151913,14 @@ stage: Modified - name: Modified1510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1511 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151942,14 +151942,14 @@ stage: Modified - name: Modified1512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1513 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1832\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -151971,7 +151971,7 @@ stage: Modified - name: Modified1514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1832\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1832\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -151979,7 +151979,7 @@ stage: Modified - name: Modified1515 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1833\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152001,7 +152001,7 @@ stage: Modified - name: Modified1516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1833\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1833\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152009,7 +152009,7 @@ stage: Modified - name: Modified1517 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1834\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152031,14 +152031,14 @@ stage: Modified - name: Modified1518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1834\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1834\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1519 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1835\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152060,14 +152060,14 @@ stage: Modified - name: Modified1520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1835\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1835\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1521 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1836\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152089,7 +152089,7 @@ stage: Modified - name: Modified1522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1836\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1836\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152097,7 +152097,7 @@ stage: Modified - name: Modified1523 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1837\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152119,7 +152119,7 @@ stage: Modified - name: Modified1524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1837\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1837\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152127,7 +152127,7 @@ stage: Modified - name: Modified1525 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1838\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152149,14 +152149,14 @@ stage: Modified - name: Modified1526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1838\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1838\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1527 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1839\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152178,14 +152178,14 @@ stage: Modified - name: Modified1528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1839\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1839\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152193,7 +152193,7 @@ stage: Modified - name: Modified1530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152201,7 +152201,7 @@ stage: Modified - name: Modified1531 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152209,7 +152209,7 @@ stage: Modified - name: Modified1532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152217,7 +152217,7 @@ stage: Modified - name: Modified1533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152225,14 +152225,14 @@ stage: Modified - name: Modified1534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1535 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152240,14 +152240,14 @@ stage: Modified - name: Modified1536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1537 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152255,7 +152255,7 @@ stage: Modified - name: Modified1538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152263,7 +152263,7 @@ stage: Modified - name: Modified1539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152271,7 +152271,7 @@ stage: Modified - name: Modified1540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152279,7 +152279,7 @@ stage: Modified - name: Modified1541 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152287,14 +152287,14 @@ stage: Modified - name: Modified1542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1543 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770022,"checksum":"dc05cd5b6a4f668362b050eee0cf81aade40c02f"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152302,14 +152302,14 @@ stage: Modified - name: Modified1544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152317,7 +152317,7 @@ stage: Modified - name: Modified1546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1848\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152325,7 +152325,7 @@ stage: Modified - name: Modified1547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152333,7 +152333,7 @@ stage: Modified - name: Modified1548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1849\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152341,7 +152341,7 @@ stage: Modified - name: Modified1549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152349,14 +152349,14 @@ stage: Modified - name: Modified1550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1850\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152364,14 +152364,14 @@ stage: Modified - name: Modified1552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1851\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152379,7 +152379,7 @@ stage: Modified - name: Modified1554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1852\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152387,7 +152387,7 @@ stage: Modified - name: Modified1555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152395,7 +152395,7 @@ stage: Modified - name: Modified1556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1853\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152403,7 +152403,7 @@ stage: Modified - name: Modified1557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152411,14 +152411,14 @@ stage: Modified - name: Modified1558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1854\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key", "arch": "[x64]", "timestamp": 1606816911, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -152426,14 +152426,14 @@ stage: Modified - name: Modified1560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1855\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1561 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152455,7 +152455,7 @@ stage: Modified - name: Modified1562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152463,7 +152463,7 @@ stage: Modified - name: Modified1563 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152485,7 +152485,7 @@ stage: Modified - name: Modified1564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152493,7 +152493,7 @@ stage: Modified - name: Modified1565 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152515,14 +152515,14 @@ stage: Modified - name: Modified1566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1567 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152544,14 +152544,14 @@ stage: Modified - name: Modified1568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1569 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816911,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152573,7 +152573,7 @@ stage: Modified - name: Modified1570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816911,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816911, "attributes": @@ -152581,7 +152581,7 @@ stage: Modified - name: Modified1571 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152603,7 +152603,7 @@ stage: Modified - name: Modified1572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -152611,7 +152611,7 @@ stage: Modified - name: Modified1573 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152633,14 +152633,14 @@ stage: Modified - name: Modified1574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1575 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152662,14 +152662,14 @@ stage: Modified - name: Modified1576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1577 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1864\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152691,7 +152691,7 @@ stage: Modified - name: Modified1578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1864\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1864\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -152699,7 +152699,7 @@ stage: Modified - name: Modified1579 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1865\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152721,7 +152721,7 @@ stage: Modified - name: Modified1580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1865\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1865\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -152729,7 +152729,7 @@ stage: Modified - name: Modified1581 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1866\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152751,14 +152751,14 @@ stage: Modified - name: Modified1582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1866\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1866\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1583 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1867\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152780,14 +152780,14 @@ stage: Modified - name: Modified1584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1867\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1867\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1585 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1868\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152809,7 +152809,7 @@ stage: Modified - name: Modified1586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1868\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1868\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -152817,7 +152817,7 @@ stage: Modified - name: Modified1587 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1869\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152839,7 +152839,7 @@ stage: Modified - name: Modified1588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1869\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1869\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -152847,7 +152847,7 @@ stage: Modified - name: Modified1589 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1870\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152869,14 +152869,14 @@ stage: Modified - name: Modified1590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1870\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1870\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1591 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1871\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -152898,14 +152898,14 @@ stage: Modified - name: Modified1592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1871\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1871\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770022,"checksum":"74883ca329570ab9771982def61e94b3477dfdda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770022,"checksum":"74883ca329570ab9771982def61e94b3477dfdda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key", "arch": "[x64]", "timestamp": 1606816912, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -152913,7 +152913,7 @@ stage: Modified - name: Modified1594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -152921,7 +152921,7 @@ stage: Modified - name: Modified1595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770022,"checksum":"74883ca329570ab9771982def61e94b3477dfdda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770022,"checksum":"74883ca329570ab9771982def61e94b3477dfdda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key", "arch": "[x64]", "timestamp": 1606816912, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -152929,7 +152929,7 @@ stage: Modified - name: Modified1596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -152937,7 +152937,7 @@ stage: Modified - name: Modified1597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770022,"checksum":"74883ca329570ab9771982def61e94b3477dfdda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770022,"checksum":"74883ca329570ab9771982def61e94b3477dfdda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key", "arch": "[x64]", "timestamp": 1606816912, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -152945,14 +152945,14 @@ stage: Modified - name: Modified1598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770022,"checksum":"74883ca329570ab9771982def61e94b3477dfdda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770022,"checksum":"74883ca329570ab9771982def61e94b3477dfdda"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key", "arch": "[x64]", "timestamp": 1606816912, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -152960,14 +152960,14 @@ stage: Modified - name: Modified1600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770023,"checksum":"c288467ad07308636494567f18b9082210b80204"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770023,"checksum":"c288467ad07308636494567f18b9082210b80204"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key", "arch": "[x64]", "timestamp": 1606816912, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -152975,7 +152975,7 @@ stage: Modified - name: Modified1602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -152983,7 +152983,7 @@ stage: Modified - name: Modified1603 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770023,"checksum":"c288467ad07308636494567f18b9082210b80204"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770023,"checksum":"c288467ad07308636494567f18b9082210b80204"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key", "arch": "[x64]", "timestamp": 1606816912, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -152991,7 +152991,7 @@ stage: Modified - name: Modified1604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -152999,7 +152999,7 @@ stage: Modified - name: Modified1605 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770023,"checksum":"c288467ad07308636494567f18b9082210b80204"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770023,"checksum":"c288467ad07308636494567f18b9082210b80204"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key", "arch": "[x64]", "timestamp": 1606816912, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -153007,14 +153007,14 @@ stage: Modified - name: Modified1606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770023,"checksum":"c288467ad07308636494567f18b9082210b80204"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770023,"checksum":"c288467ad07308636494567f18b9082210b80204"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key", "arch": "[x64]", "timestamp": 1606816912, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -153022,14 +153022,14 @@ stage: Modified - name: Modified1608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1609 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1880\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1880\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -153037,7 +153037,7 @@ stage: Modified - name: Modified1610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1881\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1881\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -153045,21 +153045,21 @@ stage: Modified - name: Modified1611 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1882\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1882\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1883\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1883\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1884\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1884\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -153067,7 +153067,7 @@ stage: Modified - name: Modified1614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1885\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1885\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -153075,21 +153075,21 @@ stage: Modified - name: Modified1615 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1886\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1886\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1887\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1887\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1617 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153110,7 +153110,7 @@ stage: Modified - name: Modified1618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -153118,7 +153118,7 @@ stage: Modified - name: Modified1619 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153139,7 +153139,7 @@ stage: Modified - name: Modified1620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -153147,7 +153147,7 @@ stage: Modified - name: Modified1621 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153168,14 +153168,14 @@ stage: Modified - name: Modified1622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1623 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153196,14 +153196,14 @@ stage: Modified - name: Modified1624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1625 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153224,7 +153224,7 @@ stage: Modified - name: Modified1626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -153232,7 +153232,7 @@ stage: Modified - name: Modified1627 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153253,7 +153253,7 @@ stage: Modified - name: Modified1628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -153261,7 +153261,7 @@ stage: Modified - name: Modified1629 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153282,14 +153282,14 @@ stage: Modified - name: Modified1630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1631 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153310,14 +153310,14 @@ stage: Modified - name: Modified1632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1633 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1896\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816912,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153338,7 +153338,7 @@ stage: Modified - name: Modified1634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1896\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816912,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1896\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816912, "attributes": @@ -153346,7 +153346,7 @@ stage: Modified - name: Modified1635 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1897\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153367,7 +153367,7 @@ stage: Modified - name: Modified1636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1897\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1897\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": @@ -153375,7 +153375,7 @@ stage: Modified - name: Modified1637 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1898\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153396,14 +153396,14 @@ stage: Modified - name: Modified1638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1898\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1898\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1639 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1899\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153424,14 +153424,14 @@ stage: Modified - name: Modified1640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1899\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1899\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1641 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1900\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153452,7 +153452,7 @@ stage: Modified - name: Modified1642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1900\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1900\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": @@ -153460,7 +153460,7 @@ stage: Modified - name: Modified1643 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1901\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153481,7 +153481,7 @@ stage: Modified - name: Modified1644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1901\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1901\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": @@ -153489,7 +153489,7 @@ stage: Modified - name: Modified1645 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1902\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153510,14 +153510,14 @@ stage: Modified - name: Modified1646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1902\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1902\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1647 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1903\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153538,21 +153538,21 @@ stage: Modified - name: Modified1648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1903\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1903\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key", "arch": "[x64]", "timestamp": 1606816913, "attributes": {"type": "registry_key", "mtime": 1606770023, "checksum": "7c100d90ce390c48e1b5095c32ee2e54072ab10d"}}' stage: Modified - name: Modified1650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": @@ -153560,14 +153560,14 @@ stage: Modified - name: Modified1651 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key", "arch": "[x64]", "timestamp": 1606816913, "attributes": {"type": "registry_key", "mtime": 1606770023, "checksum": "7c100d90ce390c48e1b5095c32ee2e54072ab10d"}}' stage: Modified - name: Modified1652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": @@ -153575,42 +153575,42 @@ stage: Modified - name: Modified1653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key", "arch": "[x64]", "timestamp": 1606816913, "attributes": {"type": "registry_key", "mtime": 1606770023, "checksum": "7c100d90ce390c48e1b5095c32ee2e54072ab10d"}}' stage: Modified - name: Modified1654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key", "arch": "[x64]", "timestamp": 1606816913, "attributes": {"type": "registry_key", "mtime": 1606770023, "checksum": "7c100d90ce390c48e1b5095c32ee2e54072ab10d"}}' stage: Modified - name: Modified1656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1657 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key", "arch": "[x64]", "timestamp": 1606816913, "attributes": {"type": "registry_key", "mtime": 1606770023, "checksum": "7c100d90ce390c48e1b5095c32ee2e54072ab10d"}}' stage: Modified - name: Modified1658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": @@ -153618,14 +153618,14 @@ stage: Modified - name: Modified1659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key", "arch": "[x64]", "timestamp": 1606816913, "attributes": {"type": "registry_key", "mtime": 1606770023, "checksum": "7c100d90ce390c48e1b5095c32ee2e54072ab10d"}}' stage: Modified - name: Modified1660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": @@ -153633,35 +153633,35 @@ stage: Modified - name: Modified1661 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key", "arch": "[x64]", "timestamp": 1606816913, "attributes": {"type": "registry_key", "mtime": 1606770023, "checksum": "7c100d90ce390c48e1b5095c32ee2e54072ab10d"}}' stage: Modified - name: Modified1662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1663 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","mtime":1606770023,"checksum":"7c100d90ce390c48e1b5095c32ee2e54072ab10d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key", "arch": "[x64]", "timestamp": 1606816913, "attributes": {"type": "registry_key", "mtime": 1606770023, "checksum": "7c100d90ce390c48e1b5095c32ee2e54072ab10d"}}' stage: Modified - name: Modified1664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1912\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1912\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": @@ -153669,7 +153669,7 @@ stage: Modified - name: Modified1666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1913\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1913\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": @@ -153677,21 +153677,21 @@ stage: Modified - name: Modified1667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1914\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1914\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1915\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1915\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1916\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1916\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": @@ -153699,7 +153699,7 @@ stage: Modified - name: Modified1670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1917\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1917\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": @@ -153707,21 +153707,21 @@ stage: Modified - name: Modified1671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1918\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1918\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1919\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816913,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1919\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816913, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified1673 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1920\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153744,7 +153744,7 @@ stage: Modified - name: Modified1674 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1921\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153767,7 +153767,7 @@ stage: Modified - name: Modified1675 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1922\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153790,7 +153790,7 @@ stage: Modified - name: Modified1676 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1923\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153813,7 +153813,7 @@ stage: Modified - name: Modified1677 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1924\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153836,7 +153836,7 @@ stage: Modified - name: Modified1678 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1925\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153859,7 +153859,7 @@ stage: Modified - name: Modified1679 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1926\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153882,7 +153882,7 @@ stage: Modified - name: Modified1680 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1927\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153905,7 +153905,7 @@ stage: Modified - name: Modified1681 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1928\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153928,7 +153928,7 @@ stage: Modified - name: Modified1682 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1929\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153951,7 +153951,7 @@ stage: Modified - name: Modified1683 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1930\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153974,7 +153974,7 @@ stage: Modified - name: Modified1684 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1931\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -153997,7 +153997,7 @@ stage: Modified - name: Modified1685 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1932\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154020,7 +154020,7 @@ stage: Modified - name: Modified1686 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1933\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816913,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154043,7 +154043,7 @@ stage: Modified - name: Modified1687 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1934\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154066,7 +154066,7 @@ stage: Modified - name: Modified1688 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1935\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154089,7 +154089,7 @@ stage: Modified - name: Modified1689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154098,7 +154098,7 @@ stage: Modified - name: Modified1690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154107,7 +154107,7 @@ stage: Modified - name: Modified1691 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154116,7 +154116,7 @@ stage: Modified - name: Modified1692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154125,7 +154125,7 @@ stage: Modified - name: Modified1693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154134,7 +154134,7 @@ stage: Modified - name: Modified1694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154143,7 +154143,7 @@ stage: Modified - name: Modified1695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154152,7 +154152,7 @@ stage: Modified - name: Modified1696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770024,"checksum":"16d0b9e3ab323193600d96c62538a39ab6fdad31"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154161,7 +154161,7 @@ stage: Modified - name: Modified1697 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1944\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1944\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154170,7 +154170,7 @@ stage: Modified - name: Modified1698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1945\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1945\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154179,7 +154179,7 @@ stage: Modified - name: Modified1699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1946\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1946\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154188,7 +154188,7 @@ stage: Modified - name: Modified1700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1947\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1947\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154197,7 +154197,7 @@ stage: Modified - name: Modified1701 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1948\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1948\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154206,7 +154206,7 @@ stage: Modified - name: Modified1702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1949\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1949\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154215,7 +154215,7 @@ stage: Modified - name: Modified1703 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1950\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1950\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154224,7 +154224,7 @@ stage: Modified - name: Modified1704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1951\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1951\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154233,7 +154233,7 @@ stage: Modified - name: Modified1705 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1952\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154255,7 +154255,7 @@ stage: Modified - name: Modified1706 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1953\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154277,7 +154277,7 @@ stage: Modified - name: Modified1707 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1954\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154299,7 +154299,7 @@ stage: Modified - name: Modified1708 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1955\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154321,7 +154321,7 @@ stage: Modified - name: Modified1709 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1956\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154343,7 +154343,7 @@ stage: Modified - name: Modified1710 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1957\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154365,7 +154365,7 @@ stage: Modified - name: Modified1711 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1958\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154387,7 +154387,7 @@ stage: Modified - name: Modified1712 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1959\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154409,7 +154409,7 @@ stage: Modified - name: Modified1713 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1960\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154431,7 +154431,7 @@ stage: Modified - name: Modified1714 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1961\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154453,7 +154453,7 @@ stage: Modified - name: Modified1715 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1962\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154475,7 +154475,7 @@ stage: Modified - name: Modified1716 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1963\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154497,7 +154497,7 @@ stage: Modified - name: Modified1717 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1964\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154519,7 +154519,7 @@ stage: Modified - name: Modified1718 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1965\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154541,7 +154541,7 @@ stage: Modified - name: Modified1719 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1966\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154563,7 +154563,7 @@ stage: Modified - name: Modified1720 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1967\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154585,7 +154585,7 @@ stage: Modified - name: Modified1721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154593,7 +154593,7 @@ stage: Modified - name: Modified1722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154601,7 +154601,7 @@ stage: Modified - name: Modified1723 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154609,7 +154609,7 @@ stage: Modified - name: Modified1724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154617,7 +154617,7 @@ stage: Modified - name: Modified1725 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816914,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972\\reg_key", "arch": "[x64]", "timestamp": 1606816914, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154625,7 +154625,7 @@ stage: Modified - name: Modified1726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154633,7 +154633,7 @@ stage: Modified - name: Modified1727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154641,7 +154641,7 @@ stage: Modified - name: Modified1728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770024,"checksum":"949716ddf18fac486538912e40c71265dc8e581d"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154649,7 +154649,7 @@ stage: Modified - name: Modified1729 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1976\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1976\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154657,7 +154657,7 @@ stage: Modified - name: Modified1730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1977\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1977\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154665,7 +154665,7 @@ stage: Modified - name: Modified1731 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1978\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1978\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154673,7 +154673,7 @@ stage: Modified - name: Modified1732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1979\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1979\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154681,7 +154681,7 @@ stage: Modified - name: Modified1733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1980\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1980\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154689,7 +154689,7 @@ stage: Modified - name: Modified1734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1981\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1981\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154697,7 +154697,7 @@ stage: Modified - name: Modified1735 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1982\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1982\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154705,7 +154705,7 @@ stage: Modified - name: Modified1736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1983\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1983\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -154713,7 +154713,7 @@ stage: Modified - name: Modified1737 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1984\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154735,7 +154735,7 @@ stage: Modified - name: Modified1738 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1985\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154757,7 +154757,7 @@ stage: Modified - name: Modified1739 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1986\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154779,7 +154779,7 @@ stage: Modified - name: Modified1740 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1987\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154801,7 +154801,7 @@ stage: Modified - name: Modified1741 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1988\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154823,7 +154823,7 @@ stage: Modified - name: Modified1742 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1989\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154845,7 +154845,7 @@ stage: Modified - name: Modified1743 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1990\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154867,7 +154867,7 @@ stage: Modified - name: Modified1744 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1991\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154889,7 +154889,7 @@ stage: Modified - name: Modified1745 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1992\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154911,7 +154911,7 @@ stage: Modified - name: Modified1746 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1993\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154933,7 +154933,7 @@ stage: Modified - name: Modified1747 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1994\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154955,7 +154955,7 @@ stage: Modified - name: Modified1748 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1995\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154977,7 +154977,7 @@ stage: Modified - name: Modified1749 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1996\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -154999,7 +154999,7 @@ stage: Modified - name: Modified1750 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1997\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155021,7 +155021,7 @@ stage: Modified - name: Modified1751 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1998\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155043,7 +155043,7 @@ stage: Modified - name: Modified1752 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1999\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155065,7 +155065,7 @@ stage: Modified - name: Modified1753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -155073,7 +155073,7 @@ stage: Modified - name: Modified1754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -155081,7 +155081,7 @@ stage: Modified - name: Modified1755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -155089,7 +155089,7 @@ stage: Modified - name: Modified1756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -155097,7 +155097,7 @@ stage: Modified - name: Modified1757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -155105,7 +155105,7 @@ stage: Modified - name: Modified1758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -155113,7 +155113,7 @@ stage: Modified - name: Modified1759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -155121,7 +155121,7 @@ stage: Modified - name: Modified1760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816915,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770025,"checksum":"a2cbf3aff3114edb271d6023bd6450f7162a867e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007\\reg_key", "arch": "[x64]", "timestamp": 1606816915, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -155129,7 +155129,7 @@ stage: Modified - name: Modified1761 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2016\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155150,7 +155150,7 @@ stage: Modified - name: Modified1762 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2017\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155171,7 +155171,7 @@ stage: Modified - name: Modified1763 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2018\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155192,7 +155192,7 @@ stage: Modified - name: Modified1764 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2019\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155213,7 +155213,7 @@ stage: Modified - name: Modified1765 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2020\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155234,7 +155234,7 @@ stage: Modified - name: Modified1766 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2021\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155255,7 +155255,7 @@ stage: Modified - name: Modified1767 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2022\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155276,7 +155276,7 @@ stage: Modified - name: Modified1768 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2023\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155297,7 +155297,7 @@ stage: Modified - name: Modified1769 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2024\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155318,7 +155318,7 @@ stage: Modified - name: Modified1770 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2025\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155339,7 +155339,7 @@ stage: Modified - name: Modified1771 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2026\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155360,7 +155360,7 @@ stage: Modified - name: Modified1772 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2027\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155381,7 +155381,7 @@ stage: Modified - name: Modified1773 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2028\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155402,7 +155402,7 @@ stage: Modified - name: Modified1774 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2029\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155423,7 +155423,7 @@ stage: Modified - name: Modified1775 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2030\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155444,7 +155444,7 @@ stage: Modified - name: Modified1776 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2031\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155465,63 +155465,63 @@ stage: Modified - name: Modified1777 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032\\reg_key", "arch": "[x64]", "timestamp": 1606816916, "attributes": {"type": "registry_key", "mtime": 1606770025, "checksum": "b13acedcda097d247c00d14b24a545dc7f737da7"}}' stage: Modified - name: Modified1778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033\\reg_key", "arch": "[x64]", "timestamp": 1606816916, "attributes": {"type": "registry_key", "mtime": 1606770025, "checksum": "b13acedcda097d247c00d14b24a545dc7f737da7"}}' stage: Modified - name: Modified1779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034\\reg_key", "arch": "[x64]", "timestamp": 1606816916, "attributes": {"type": "registry_key", "mtime": 1606770025, "checksum": "b13acedcda097d247c00d14b24a545dc7f737da7"}}' stage: Modified - name: Modified1780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035\\reg_key", "arch": "[x64]", "timestamp": 1606816916, "attributes": {"type": "registry_key", "mtime": 1606770025, "checksum": "b13acedcda097d247c00d14b24a545dc7f737da7"}}' stage: Modified - name: Modified1781 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036\\reg_key", "arch": "[x64]", "timestamp": 1606816916, "attributes": {"type": "registry_key", "mtime": 1606770025, "checksum": "b13acedcda097d247c00d14b24a545dc7f737da7"}}' stage: Modified - name: Modified1782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037\\reg_key", "arch": "[x64]", "timestamp": 1606816916, "attributes": {"type": "registry_key", "mtime": 1606770025, "checksum": "b13acedcda097d247c00d14b24a545dc7f737da7"}}' stage: Modified - name: Modified1783 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038\\reg_key", "arch": "[x64]", "timestamp": 1606816916, "attributes": {"type": "registry_key", "mtime": 1606770025, "checksum": "b13acedcda097d247c00d14b24a545dc7f737da7"}}' stage: Modified - name: Modified1784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","mtime":1606770025,"checksum":"b13acedcda097d247c00d14b24a545dc7f737da7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039\\reg_key", "arch": "[x64]", "timestamp": 1606816916, "attributes": {"type": "registry_key", "mtime": 1606770025, "checksum": "b13acedcda097d247c00d14b24a545dc7f737da7"}}' stage: Modified - name: Modified1785 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155544,7 +155544,7 @@ stage: Modified - name: Modified1786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816916,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816916,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816916, "attributes": @@ -155554,7 +155554,7 @@ stage: Modified - name: Modified1787 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816916,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155577,7 +155577,7 @@ stage: Modified - name: Modified1788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816916,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816916,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816916, "attributes": @@ -155587,7 +155587,7 @@ stage: Modified - name: Modified1789 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155610,7 +155610,7 @@ stage: Modified - name: Modified1790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -155619,7 +155619,7 @@ stage: Modified - name: Modified1791 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155642,7 +155642,7 @@ stage: Modified - name: Modified1792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -155651,7 +155651,7 @@ stage: Modified - name: Modified1793 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155674,7 +155674,7 @@ stage: Modified - name: Modified1794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -155684,7 +155684,7 @@ stage: Modified - name: Modified1795 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155707,7 +155707,7 @@ stage: Modified - name: Modified1796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -155717,7 +155717,7 @@ stage: Modified - name: Modified1797 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155740,7 +155740,7 @@ stage: Modified - name: Modified1798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -155749,7 +155749,7 @@ stage: Modified - name: Modified1799 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155772,7 +155772,7 @@ stage: Modified - name: Modified1800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -155781,7 +155781,7 @@ stage: Modified - name: Modified1801 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2056\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155804,7 +155804,7 @@ stage: Modified - name: Modified1802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2056\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2056\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -155814,7 +155814,7 @@ stage: Modified - name: Modified1803 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2057\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155837,7 +155837,7 @@ stage: Modified - name: Modified1804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2057\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2057\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -155847,7 +155847,7 @@ stage: Modified - name: Modified1805 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2058\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155870,7 +155870,7 @@ stage: Modified - name: Modified1806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2058\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2058\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -155879,7 +155879,7 @@ stage: Modified - name: Modified1807 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2059\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155902,7 +155902,7 @@ stage: Modified - name: Modified1808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2059\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2059\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -155911,7 +155911,7 @@ stage: Modified - name: Modified1809 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2060\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155934,7 +155934,7 @@ stage: Modified - name: Modified1810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2060\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2060\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -155944,7 +155944,7 @@ stage: Modified - name: Modified1811 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2061\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -155967,7 +155967,7 @@ stage: Modified - name: Modified1812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2061\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2061\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -155977,7 +155977,7 @@ stage: Modified - name: Modified1813 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2062\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156000,7 +156000,7 @@ stage: Modified - name: Modified1814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2062\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2062\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156009,7 +156009,7 @@ stage: Modified - name: Modified1815 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2063\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156032,7 +156032,7 @@ stage: Modified - name: Modified1816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2063\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2063\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156041,7 +156041,7 @@ stage: Modified - name: Modified1817 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156050,7 +156050,7 @@ stage: Modified - name: Modified1818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156060,7 +156060,7 @@ stage: Modified - name: Modified1819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156069,7 +156069,7 @@ stage: Modified - name: Modified1820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156079,7 +156079,7 @@ stage: Modified - name: Modified1821 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156088,7 +156088,7 @@ stage: Modified - name: Modified1822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156097,7 +156097,7 @@ stage: Modified - name: Modified1823 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156106,7 +156106,7 @@ stage: Modified - name: Modified1824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156115,7 +156115,7 @@ stage: Modified - name: Modified1825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156124,7 +156124,7 @@ stage: Modified - name: Modified1826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156134,7 +156134,7 @@ stage: Modified - name: Modified1827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156143,7 +156143,7 @@ stage: Modified - name: Modified1828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156153,7 +156153,7 @@ stage: Modified - name: Modified1829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156162,7 +156162,7 @@ stage: Modified - name: Modified1830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156171,7 +156171,7 @@ stage: Modified - name: Modified1831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770026,"checksum":"651c90377af6f03ca7b574e26bc9d7722023e019"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156180,7 +156180,7 @@ stage: Modified - name: Modified1832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156189,7 +156189,7 @@ stage: Modified - name: Modified1833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156198,7 +156198,7 @@ stage: Modified - name: Modified1834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2072\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156208,7 +156208,7 @@ stage: Modified - name: Modified1835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156217,7 +156217,7 @@ stage: Modified - name: Modified1836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2073\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156227,7 +156227,7 @@ stage: Modified - name: Modified1837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156236,7 +156236,7 @@ stage: Modified - name: Modified1838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2074\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156245,7 +156245,7 @@ stage: Modified - name: Modified1839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156254,7 +156254,7 @@ stage: Modified - name: Modified1840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2075\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156263,7 +156263,7 @@ stage: Modified - name: Modified1841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156272,7 +156272,7 @@ stage: Modified - name: Modified1842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2076\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156282,7 +156282,7 @@ stage: Modified - name: Modified1843 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156291,7 +156291,7 @@ stage: Modified - name: Modified1844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2077\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156301,7 +156301,7 @@ stage: Modified - name: Modified1845 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156310,7 +156310,7 @@ stage: Modified - name: Modified1846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2078\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156319,7 +156319,7 @@ stage: Modified - name: Modified1847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key", "arch": "[x64]", "timestamp": 1606816917, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156328,7 +156328,7 @@ stage: Modified - name: Modified1848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2079\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156337,7 +156337,7 @@ stage: Modified - name: Modified1849 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156359,7 +156359,7 @@ stage: Modified - name: Modified1850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156369,7 +156369,7 @@ stage: Modified - name: Modified1851 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156391,7 +156391,7 @@ stage: Modified - name: Modified1852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156401,7 +156401,7 @@ stage: Modified - name: Modified1853 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156423,7 +156423,7 @@ stage: Modified - name: Modified1854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156432,7 +156432,7 @@ stage: Modified - name: Modified1855 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156454,7 +156454,7 @@ stage: Modified - name: Modified1856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156463,7 +156463,7 @@ stage: Modified - name: Modified1857 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156485,7 +156485,7 @@ stage: Modified - name: Modified1858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156495,7 +156495,7 @@ stage: Modified - name: Modified1859 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156517,7 +156517,7 @@ stage: Modified - name: Modified1860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": @@ -156527,7 +156527,7 @@ stage: Modified - name: Modified1861 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816917,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156549,7 +156549,7 @@ stage: Modified - name: Modified1862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816917,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816917, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156558,7 +156558,7 @@ stage: Modified - name: Modified1863 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156580,7 +156580,7 @@ stage: Modified - name: Modified1864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156589,7 +156589,7 @@ stage: Modified - name: Modified1865 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2088\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156611,7 +156611,7 @@ stage: Modified - name: Modified1866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2088\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2088\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -156621,7 +156621,7 @@ stage: Modified - name: Modified1867 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2089\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156643,7 +156643,7 @@ stage: Modified - name: Modified1868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2089\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2089\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -156653,7 +156653,7 @@ stage: Modified - name: Modified1869 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2090\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156675,7 +156675,7 @@ stage: Modified - name: Modified1870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2090\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2090\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156684,7 +156684,7 @@ stage: Modified - name: Modified1871 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2091\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156706,7 +156706,7 @@ stage: Modified - name: Modified1872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2091\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2091\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156715,7 +156715,7 @@ stage: Modified - name: Modified1873 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2092\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156737,7 +156737,7 @@ stage: Modified - name: Modified1874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2092\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2092\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -156747,7 +156747,7 @@ stage: Modified - name: Modified1875 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2093\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156769,7 +156769,7 @@ stage: Modified - name: Modified1876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2093\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2093\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -156779,7 +156779,7 @@ stage: Modified - name: Modified1877 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2094\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156801,7 +156801,7 @@ stage: Modified - name: Modified1878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2094\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2094\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156810,7 +156810,7 @@ stage: Modified - name: Modified1879 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2095\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -156832,7 +156832,7 @@ stage: Modified - name: Modified1880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2095\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2095\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156841,7 +156841,7 @@ stage: Modified - name: Modified1881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156849,7 +156849,7 @@ stage: Modified - name: Modified1882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -156859,7 +156859,7 @@ stage: Modified - name: Modified1883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156867,7 +156867,7 @@ stage: Modified - name: Modified1884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -156877,7 +156877,7 @@ stage: Modified - name: Modified1885 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156885,7 +156885,7 @@ stage: Modified - name: Modified1886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156894,7 +156894,7 @@ stage: Modified - name: Modified1887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156902,7 +156902,7 @@ stage: Modified - name: Modified1888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156911,7 +156911,7 @@ stage: Modified - name: Modified1889 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156919,7 +156919,7 @@ stage: Modified - name: Modified1890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -156929,7 +156929,7 @@ stage: Modified - name: Modified1891 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156937,7 +156937,7 @@ stage: Modified - name: Modified1892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -156947,7 +156947,7 @@ stage: Modified - name: Modified1893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156955,7 +156955,7 @@ stage: Modified - name: Modified1894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156964,7 +156964,7 @@ stage: Modified - name: Modified1895 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770026,"checksum":"30ed4b54876257b70e815a9c1107e9e88018eead"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156972,7 +156972,7 @@ stage: Modified - name: Modified1896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -156981,7 +156981,7 @@ stage: Modified - name: Modified1897 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -156989,7 +156989,7 @@ stage: Modified - name: Modified1898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2104\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -156999,7 +156999,7 @@ stage: Modified - name: Modified1899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -157007,7 +157007,7 @@ stage: Modified - name: Modified1900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2105\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -157017,7 +157017,7 @@ stage: Modified - name: Modified1901 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -157025,7 +157025,7 @@ stage: Modified - name: Modified1902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2106\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157034,7 +157034,7 @@ stage: Modified - name: Modified1903 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -157042,7 +157042,7 @@ stage: Modified - name: Modified1904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2107\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157051,7 +157051,7 @@ stage: Modified - name: Modified1905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -157059,7 +157059,7 @@ stage: Modified - name: Modified1906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2108\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -157069,7 +157069,7 @@ stage: Modified - name: Modified1907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -157077,7 +157077,7 @@ stage: Modified - name: Modified1908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2109\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -157087,7 +157087,7 @@ stage: Modified - name: Modified1909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -157095,7 +157095,7 @@ stage: Modified - name: Modified1910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2110\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157104,7 +157104,7 @@ stage: Modified - name: Modified1911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key", "arch": "[x64]", "timestamp": 1606816918, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -157112,7 +157112,7 @@ stage: Modified - name: Modified1912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2111\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157121,7 +157121,7 @@ stage: Modified - name: Modified1913 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157143,7 +157143,7 @@ stage: Modified - name: Modified1914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -157153,7 +157153,7 @@ stage: Modified - name: Modified1915 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157175,7 +157175,7 @@ stage: Modified - name: Modified1916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -157185,7 +157185,7 @@ stage: Modified - name: Modified1917 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157207,7 +157207,7 @@ stage: Modified - name: Modified1918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157216,7 +157216,7 @@ stage: Modified - name: Modified1919 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157238,7 +157238,7 @@ stage: Modified - name: Modified1920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157247,7 +157247,7 @@ stage: Modified - name: Modified1921 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157269,7 +157269,7 @@ stage: Modified - name: Modified1922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -157279,7 +157279,7 @@ stage: Modified - name: Modified1923 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157301,7 +157301,7 @@ stage: Modified - name: Modified1924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -157311,7 +157311,7 @@ stage: Modified - name: Modified1925 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157333,7 +157333,7 @@ stage: Modified - name: Modified1926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157342,7 +157342,7 @@ stage: Modified - name: Modified1927 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157364,7 +157364,7 @@ stage: Modified - name: Modified1928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157373,7 +157373,7 @@ stage: Modified - name: Modified1929 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2120\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157395,7 +157395,7 @@ stage: Modified - name: Modified1930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2120\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2120\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -157405,7 +157405,7 @@ stage: Modified - name: Modified1931 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2121\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816918,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157427,7 +157427,7 @@ stage: Modified - name: Modified1932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2121\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816918,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2121\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816918, "attributes": @@ -157437,7 +157437,7 @@ stage: Modified - name: Modified1933 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2122\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157459,7 +157459,7 @@ stage: Modified - name: Modified1934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2122\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2122\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157468,7 +157468,7 @@ stage: Modified - name: Modified1935 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2123\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157490,7 +157490,7 @@ stage: Modified - name: Modified1936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2123\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2123\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157499,7 +157499,7 @@ stage: Modified - name: Modified1937 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2124\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157521,7 +157521,7 @@ stage: Modified - name: Modified1938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2124\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2124\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157531,7 +157531,7 @@ stage: Modified - name: Modified1939 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2125\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157553,7 +157553,7 @@ stage: Modified - name: Modified1940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2125\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2125\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157563,7 +157563,7 @@ stage: Modified - name: Modified1941 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2126\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157585,7 +157585,7 @@ stage: Modified - name: Modified1942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2126\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2126\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157594,7 +157594,7 @@ stage: Modified - name: Modified1943 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2127\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157616,7 +157616,7 @@ stage: Modified - name: Modified1944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2127\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2127\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157625,7 +157625,7 @@ stage: Modified - name: Modified1945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key", "arch": "[x64]", "timestamp": 1606816919, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -157633,7 +157633,7 @@ stage: Modified - name: Modified1946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157643,7 +157643,7 @@ stage: Modified - name: Modified1947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key", "arch": "[x64]", "timestamp": 1606816919, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -157651,7 +157651,7 @@ stage: Modified - name: Modified1948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157661,7 +157661,7 @@ stage: Modified - name: Modified1949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key", "arch": "[x64]", "timestamp": 1606816919, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -157669,7 +157669,7 @@ stage: Modified - name: Modified1950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157678,7 +157678,7 @@ stage: Modified - name: Modified1951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key", "arch": "[x64]", "timestamp": 1606816919, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -157686,7 +157686,7 @@ stage: Modified - name: Modified1952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157695,7 +157695,7 @@ stage: Modified - name: Modified1953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key", "arch": "[x64]", "timestamp": 1606816919, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -157703,7 +157703,7 @@ stage: Modified - name: Modified1954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157713,7 +157713,7 @@ stage: Modified - name: Modified1955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key", "arch": "[x64]", "timestamp": 1606816919, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -157721,7 +157721,7 @@ stage: Modified - name: Modified1956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157731,7 +157731,7 @@ stage: Modified - name: Modified1957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key", "arch": "[x64]", "timestamp": 1606816919, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -157739,7 +157739,7 @@ stage: Modified - name: Modified1958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157748,7 +157748,7 @@ stage: Modified - name: Modified1959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770027,"checksum":"6831e1f29bcf3a215150b79574a5847f3b31de9a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key", "arch": "[x64]", "timestamp": 1606816919, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -157756,7 +157756,7 @@ stage: Modified - name: Modified1960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157765,7 +157765,7 @@ stage: Modified - name: Modified1961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2136\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2136\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157775,7 +157775,7 @@ stage: Modified - name: Modified1962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2137\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2137\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157785,7 +157785,7 @@ stage: Modified - name: Modified1963 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2138\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2138\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157794,7 +157794,7 @@ stage: Modified - name: Modified1964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2139\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2139\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157803,7 +157803,7 @@ stage: Modified - name: Modified1965 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2140\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2140\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157813,7 +157813,7 @@ stage: Modified - name: Modified1966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2141\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2141\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157823,7 +157823,7 @@ stage: Modified - name: Modified1967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2142\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2142\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157832,7 +157832,7 @@ stage: Modified - name: Modified1968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2143\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2143\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157841,7 +157841,7 @@ stage: Modified - name: Modified1969 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157862,7 +157862,7 @@ stage: Modified - name: Modified1970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157872,7 +157872,7 @@ stage: Modified - name: Modified1971 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157893,7 +157893,7 @@ stage: Modified - name: Modified1972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157903,7 +157903,7 @@ stage: Modified - name: Modified1973 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157924,7 +157924,7 @@ stage: Modified - name: Modified1974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157933,7 +157933,7 @@ stage: Modified - name: Modified1975 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157954,7 +157954,7 @@ stage: Modified - name: Modified1976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -157963,7 +157963,7 @@ stage: Modified - name: Modified1977 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -157984,7 +157984,7 @@ stage: Modified - name: Modified1978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -157994,7 +157994,7 @@ stage: Modified - name: Modified1979 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158015,7 +158015,7 @@ stage: Modified - name: Modified1980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -158025,7 +158025,7 @@ stage: Modified - name: Modified1981 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158046,7 +158046,7 @@ stage: Modified - name: Modified1982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158055,7 +158055,7 @@ stage: Modified - name: Modified1983 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158076,7 +158076,7 @@ stage: Modified - name: Modified1984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158085,7 +158085,7 @@ stage: Modified - name: Modified1985 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2152\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158106,7 +158106,7 @@ stage: Modified - name: Modified1986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2152\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2152\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -158116,7 +158116,7 @@ stage: Modified - name: Modified1987 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2153\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158137,7 +158137,7 @@ stage: Modified - name: Modified1988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2153\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2153\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -158147,7 +158147,7 @@ stage: Modified - name: Modified1989 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2154\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158168,7 +158168,7 @@ stage: Modified - name: Modified1990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2154\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2154\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158177,7 +158177,7 @@ stage: Modified - name: Modified1991 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2155\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158198,7 +158198,7 @@ stage: Modified - name: Modified1992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2155\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2155\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158207,7 +158207,7 @@ stage: Modified - name: Modified1993 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2156\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816919,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158228,7 +158228,7 @@ stage: Modified - name: Modified1994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2156\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816919,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2156\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816919, "attributes": @@ -158238,7 +158238,7 @@ stage: Modified - name: Modified1995 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2157\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158259,7 +158259,7 @@ stage: Modified - name: Modified1996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2157\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2157\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158269,7 +158269,7 @@ stage: Modified - name: Modified1997 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2158\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158290,7 +158290,7 @@ stage: Modified - name: Modified1998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2158\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2158\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158299,7 +158299,7 @@ stage: Modified - name: Modified1999 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2159\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158320,7 +158320,7 @@ stage: Modified - name: Modified2000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2159\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2159\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158329,14 +158329,14 @@ stage: Modified - name: Modified2001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770027,"checksum":"4c6a7157506ad5554878bfe525fdc457818d0160"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770027,"checksum":"4c6a7157506ad5554878bfe525fdc457818d0160"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key", "arch": "[x64]", "timestamp": 1606816920, "attributes": {"type": "registry_key", "mtime": 1606770027, "checksum": "4c6a7157506ad5554878bfe525fdc457818d0160"}}' stage: Modified - name: Modified2002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158346,14 +158346,14 @@ stage: Modified - name: Modified2003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770027,"checksum":"4c6a7157506ad5554878bfe525fdc457818d0160"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770027,"checksum":"4c6a7157506ad5554878bfe525fdc457818d0160"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key", "arch": "[x64]", "timestamp": 1606816920, "attributes": {"type": "registry_key", "mtime": 1606770027, "checksum": "4c6a7157506ad5554878bfe525fdc457818d0160"}}' stage: Modified - name: Modified2004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158363,14 +158363,14 @@ stage: Modified - name: Modified2005 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770027,"checksum":"4c6a7157506ad5554878bfe525fdc457818d0160"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770027,"checksum":"4c6a7157506ad5554878bfe525fdc457818d0160"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key", "arch": "[x64]", "timestamp": 1606816920, "attributes": {"type": "registry_key", "mtime": 1606770027, "checksum": "4c6a7157506ad5554878bfe525fdc457818d0160"}}' stage: Modified - name: Modified2006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158379,14 +158379,14 @@ stage: Modified - name: Modified2007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770028,"checksum":"250a274ceedff3fa406cb1175e790203f3dcc095"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770028,"checksum":"250a274ceedff3fa406cb1175e790203f3dcc095"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key", "arch": "[x64]", "timestamp": 1606816920, "attributes": {"type": "registry_key", "mtime": 1606770028, "checksum": "250a274ceedff3fa406cb1175e790203f3dcc095"}}' stage: Modified - name: Modified2008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158395,14 +158395,14 @@ stage: Modified - name: Modified2009 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770028,"checksum":"250a274ceedff3fa406cb1175e790203f3dcc095"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770028,"checksum":"250a274ceedff3fa406cb1175e790203f3dcc095"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key", "arch": "[x64]", "timestamp": 1606816920, "attributes": {"type": "registry_key", "mtime": 1606770028, "checksum": "250a274ceedff3fa406cb1175e790203f3dcc095"}}' stage: Modified - name: Modified2010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158412,14 +158412,14 @@ stage: Modified - name: Modified2011 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770028,"checksum":"250a274ceedff3fa406cb1175e790203f3dcc095"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770028,"checksum":"250a274ceedff3fa406cb1175e790203f3dcc095"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key", "arch": "[x64]", "timestamp": 1606816920, "attributes": {"type": "registry_key", "mtime": 1606770028, "checksum": "250a274ceedff3fa406cb1175e790203f3dcc095"}}' stage: Modified - name: Modified2012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158429,14 +158429,14 @@ stage: Modified - name: Modified2013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770028,"checksum":"250a274ceedff3fa406cb1175e790203f3dcc095"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770028,"checksum":"250a274ceedff3fa406cb1175e790203f3dcc095"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key", "arch": "[x64]", "timestamp": 1606816920, "attributes": {"type": "registry_key", "mtime": 1606770028, "checksum": "250a274ceedff3fa406cb1175e790203f3dcc095"}}' stage: Modified - name: Modified2014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158445,14 +158445,14 @@ stage: Modified - name: Modified2015 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770028,"checksum":"250a274ceedff3fa406cb1175e790203f3dcc095"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","mtime":1606770028,"checksum":"250a274ceedff3fa406cb1175e790203f3dcc095"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key", "arch": "[x64]", "timestamp": 1606816920, "attributes": {"type": "registry_key", "mtime": 1606770028, "checksum": "250a274ceedff3fa406cb1175e790203f3dcc095"}}' stage: Modified - name: Modified2016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158461,7 +158461,7 @@ stage: Modified - name: Modified2017 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2168\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2168\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158471,7 +158471,7 @@ stage: Modified - name: Modified2018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2169\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2169\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158481,7 +158481,7 @@ stage: Modified - name: Modified2019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2170\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2170\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158490,7 +158490,7 @@ stage: Modified - name: Modified2020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2171\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2171\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158499,7 +158499,7 @@ stage: Modified - name: Modified2021 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2172\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2172\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158509,7 +158509,7 @@ stage: Modified - name: Modified2022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2173\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2173\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158519,7 +158519,7 @@ stage: Modified - name: Modified2023 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2174\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2174\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158528,7 +158528,7 @@ stage: Modified - name: Modified2024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2175\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["size","md5","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2175\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158537,7 +158537,7 @@ stage: Modified - name: Modified2025 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158560,7 +158560,7 @@ stage: Modified - name: Modified2026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158570,7 +158570,7 @@ stage: Modified - name: Modified2027 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158593,7 +158593,7 @@ stage: Modified - name: Modified2028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158603,7 +158603,7 @@ stage: Modified - name: Modified2029 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158626,7 +158626,7 @@ stage: Modified - name: Modified2030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158635,7 +158635,7 @@ stage: Modified - name: Modified2031 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158658,7 +158658,7 @@ stage: Modified - name: Modified2032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158667,7 +158667,7 @@ stage: Modified - name: Modified2033 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158690,7 +158690,7 @@ stage: Modified - name: Modified2034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158700,7 +158700,7 @@ stage: Modified - name: Modified2035 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158723,7 +158723,7 @@ stage: Modified - name: Modified2036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158733,7 +158733,7 @@ stage: Modified - name: Modified2037 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158756,7 +158756,7 @@ stage: Modified - name: Modified2038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -158765,7 +158765,7 @@ stage: Modified - name: Modified2039 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158788,7 +158788,7 @@ stage: Modified - name: Modified2040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -158797,7 +158797,7 @@ stage: Modified - name: Modified2041 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2184\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158820,7 +158820,7 @@ stage: Modified - name: Modified2042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2184\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2184\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158830,7 +158830,7 @@ stage: Modified - name: Modified2043 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2185\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158853,7 +158853,7 @@ stage: Modified - name: Modified2044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2185\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2185\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158863,7 +158863,7 @@ stage: Modified - name: Modified2045 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2186\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158886,7 +158886,7 @@ stage: Modified - name: Modified2046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2186\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2186\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158895,7 +158895,7 @@ stage: Modified - name: Modified2047 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2187\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158918,7 +158918,7 @@ stage: Modified - name: Modified2048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2187\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2187\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -158927,7 +158927,7 @@ stage: Modified - name: Modified2049 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2188\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158950,7 +158950,7 @@ stage: Modified - name: Modified2050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2188\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2188\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158960,7 +158960,7 @@ stage: Modified - name: Modified2051 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2189\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -158983,7 +158983,7 @@ stage: Modified - name: Modified2052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2189\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2189\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -158993,7 +158993,7 @@ stage: Modified - name: Modified2053 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2190\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159016,7 +159016,7 @@ stage: Modified - name: Modified2054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2190\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2190\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159025,7 +159025,7 @@ stage: Modified - name: Modified2055 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2191\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159048,7 +159048,7 @@ stage: Modified - name: Modified2056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2191\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2191\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159057,7 +159057,7 @@ stage: Modified - name: Modified2057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816920,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key", "arch": "[x64]", "timestamp": 1606816920, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159066,7 +159066,7 @@ stage: Modified - name: Modified2058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816920,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816920, "attributes": @@ -159076,7 +159076,7 @@ stage: Modified - name: Modified2059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159085,7 +159085,7 @@ stage: Modified - name: Modified2060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159095,7 +159095,7 @@ stage: Modified - name: Modified2061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159104,7 +159104,7 @@ stage: Modified - name: Modified2062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -159113,7 +159113,7 @@ stage: Modified - name: Modified2063 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159122,7 +159122,7 @@ stage: Modified - name: Modified2064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -159131,7 +159131,7 @@ stage: Modified - name: Modified2065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159140,7 +159140,7 @@ stage: Modified - name: Modified2066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159150,7 +159150,7 @@ stage: Modified - name: Modified2067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159159,7 +159159,7 @@ stage: Modified - name: Modified2068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159169,7 +159169,7 @@ stage: Modified - name: Modified2069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159178,7 +159178,7 @@ stage: Modified - name: Modified2070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159187,7 +159187,7 @@ stage: Modified - name: Modified2071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770028,"checksum":"8ac11b43949746bd7f09dfb4d54a95e9e6abb21c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159196,7 +159196,7 @@ stage: Modified - name: Modified2072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159205,7 +159205,7 @@ stage: Modified - name: Modified2073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159214,7 +159214,7 @@ stage: Modified - name: Modified2074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2200\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159224,7 +159224,7 @@ stage: Modified - name: Modified2075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159233,7 +159233,7 @@ stage: Modified - name: Modified2076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2201\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159243,7 +159243,7 @@ stage: Modified - name: Modified2077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159252,7 +159252,7 @@ stage: Modified - name: Modified2078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2202\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -159261,7 +159261,7 @@ stage: Modified - name: Modified2079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159270,7 +159270,7 @@ stage: Modified - name: Modified2080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2203\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -159279,7 +159279,7 @@ stage: Modified - name: Modified2081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159288,7 +159288,7 @@ stage: Modified - name: Modified2082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2204\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159298,7 +159298,7 @@ stage: Modified - name: Modified2083 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159307,7 +159307,7 @@ stage: Modified - name: Modified2084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2205\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159317,7 +159317,7 @@ stage: Modified - name: Modified2085 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159326,7 +159326,7 @@ stage: Modified - name: Modified2086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2206\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159335,7 +159335,7 @@ stage: Modified - name: Modified2087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159344,7 +159344,7 @@ stage: Modified - name: Modified2088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2207\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159353,7 +159353,7 @@ stage: Modified - name: Modified2089 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159375,7 +159375,7 @@ stage: Modified - name: Modified2090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159385,7 +159385,7 @@ stage: Modified - name: Modified2091 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159407,7 +159407,7 @@ stage: Modified - name: Modified2092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159417,7 +159417,7 @@ stage: Modified - name: Modified2093 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159439,7 +159439,7 @@ stage: Modified - name: Modified2094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -159448,7 +159448,7 @@ stage: Modified - name: Modified2095 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159470,7 +159470,7 @@ stage: Modified - name: Modified2096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -159479,7 +159479,7 @@ stage: Modified - name: Modified2097 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159501,7 +159501,7 @@ stage: Modified - name: Modified2098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159511,7 +159511,7 @@ stage: Modified - name: Modified2099 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159533,7 +159533,7 @@ stage: Modified - name: Modified2100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159543,7 +159543,7 @@ stage: Modified - name: Modified2101 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159565,7 +159565,7 @@ stage: Modified - name: Modified2102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159574,7 +159574,7 @@ stage: Modified - name: Modified2103 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159596,7 +159596,7 @@ stage: Modified - name: Modified2104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159605,7 +159605,7 @@ stage: Modified - name: Modified2105 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2216\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159627,7 +159627,7 @@ stage: Modified - name: Modified2106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2216\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2216\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159637,7 +159637,7 @@ stage: Modified - name: Modified2107 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2217\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159659,7 +159659,7 @@ stage: Modified - name: Modified2108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2217\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2217\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159669,7 +159669,7 @@ stage: Modified - name: Modified2109 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2218\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159691,7 +159691,7 @@ stage: Modified - name: Modified2110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2218\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2218\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -159700,7 +159700,7 @@ stage: Modified - name: Modified2111 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2219\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159722,7 +159722,7 @@ stage: Modified - name: Modified2112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2219\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2219\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -159731,7 +159731,7 @@ stage: Modified - name: Modified2113 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2220\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159753,7 +159753,7 @@ stage: Modified - name: Modified2114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2220\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2220\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159763,7 +159763,7 @@ stage: Modified - name: Modified2115 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2221\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159785,7 +159785,7 @@ stage: Modified - name: Modified2116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2221\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2221\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159795,7 +159795,7 @@ stage: Modified - name: Modified2117 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2222\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159817,7 +159817,7 @@ stage: Modified - name: Modified2118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2222\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2222\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159826,7 +159826,7 @@ stage: Modified - name: Modified2119 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2223\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -159848,7 +159848,7 @@ stage: Modified - name: Modified2120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2223\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2223\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159857,7 +159857,7 @@ stage: Modified - name: Modified2121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159865,7 +159865,7 @@ stage: Modified - name: Modified2122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159875,7 +159875,7 @@ stage: Modified - name: Modified2123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816921,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key", "arch": "[x64]", "timestamp": 1606816921, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159883,7 +159883,7 @@ stage: Modified - name: Modified2124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816921,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816921, "attributes": @@ -159893,7 +159893,7 @@ stage: Modified - name: Modified2125 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159901,7 +159901,7 @@ stage: Modified - name: Modified2126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -159910,7 +159910,7 @@ stage: Modified - name: Modified2127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159918,7 +159918,7 @@ stage: Modified - name: Modified2128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -159927,7 +159927,7 @@ stage: Modified - name: Modified2129 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159935,7 +159935,7 @@ stage: Modified - name: Modified2130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -159945,7 +159945,7 @@ stage: Modified - name: Modified2131 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159953,7 +159953,7 @@ stage: Modified - name: Modified2132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -159963,7 +159963,7 @@ stage: Modified - name: Modified2133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159971,7 +159971,7 @@ stage: Modified - name: Modified2134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159980,7 +159980,7 @@ stage: Modified - name: Modified2135 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770029,"checksum":"476d4d4eda480afd5ac0f235101b5023eff4c539"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -159988,7 +159988,7 @@ stage: Modified - name: Modified2136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -159997,7 +159997,7 @@ stage: Modified - name: Modified2137 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -160005,7 +160005,7 @@ stage: Modified - name: Modified2138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2232\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160015,7 +160015,7 @@ stage: Modified - name: Modified2139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -160023,7 +160023,7 @@ stage: Modified - name: Modified2140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2233\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160033,7 +160033,7 @@ stage: Modified - name: Modified2141 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -160041,7 +160041,7 @@ stage: Modified - name: Modified2142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2234\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160050,7 +160050,7 @@ stage: Modified - name: Modified2143 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -160058,7 +160058,7 @@ stage: Modified - name: Modified2144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2235\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160067,7 +160067,7 @@ stage: Modified - name: Modified2145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -160075,7 +160075,7 @@ stage: Modified - name: Modified2146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2236\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160085,7 +160085,7 @@ stage: Modified - name: Modified2147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -160093,7 +160093,7 @@ stage: Modified - name: Modified2148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2237\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160103,7 +160103,7 @@ stage: Modified - name: Modified2149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -160111,7 +160111,7 @@ stage: Modified - name: Modified2150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2238\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -160120,7 +160120,7 @@ stage: Modified - name: Modified2151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -160128,7 +160128,7 @@ stage: Modified - name: Modified2152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2239\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -160137,7 +160137,7 @@ stage: Modified - name: Modified2153 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160159,7 +160159,7 @@ stage: Modified - name: Modified2154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160169,7 +160169,7 @@ stage: Modified - name: Modified2155 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160191,7 +160191,7 @@ stage: Modified - name: Modified2156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160201,7 +160201,7 @@ stage: Modified - name: Modified2157 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160223,7 +160223,7 @@ stage: Modified - name: Modified2158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160232,7 +160232,7 @@ stage: Modified - name: Modified2159 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160254,7 +160254,7 @@ stage: Modified - name: Modified2160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160263,7 +160263,7 @@ stage: Modified - name: Modified2161 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160285,7 +160285,7 @@ stage: Modified - name: Modified2162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160295,7 +160295,7 @@ stage: Modified - name: Modified2163 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160317,7 +160317,7 @@ stage: Modified - name: Modified2164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160327,7 +160327,7 @@ stage: Modified - name: Modified2165 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160349,7 +160349,7 @@ stage: Modified - name: Modified2166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -160358,7 +160358,7 @@ stage: Modified - name: Modified2167 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160380,7 +160380,7 @@ stage: Modified - name: Modified2168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -160389,7 +160389,7 @@ stage: Modified - name: Modified2169 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2248\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160411,7 +160411,7 @@ stage: Modified - name: Modified2170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2248\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2248\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160421,7 +160421,7 @@ stage: Modified - name: Modified2171 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2249\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160443,7 +160443,7 @@ stage: Modified - name: Modified2172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2249\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2249\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160453,7 +160453,7 @@ stage: Modified - name: Modified2173 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2250\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160475,7 +160475,7 @@ stage: Modified - name: Modified2174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2250\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2250\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160484,7 +160484,7 @@ stage: Modified - name: Modified2175 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2251\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160506,7 +160506,7 @@ stage: Modified - name: Modified2176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2251\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2251\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160515,7 +160515,7 @@ stage: Modified - name: Modified2177 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2252\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160537,7 +160537,7 @@ stage: Modified - name: Modified2178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2252\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2252\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160547,7 +160547,7 @@ stage: Modified - name: Modified2179 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2253\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160569,7 +160569,7 @@ stage: Modified - name: Modified2180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2253\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2253\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160579,7 +160579,7 @@ stage: Modified - name: Modified2181 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2254\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160601,7 +160601,7 @@ stage: Modified - name: Modified2182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2254\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2254\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -160610,7 +160610,7 @@ stage: Modified - name: Modified2183 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2255\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160632,7 +160632,7 @@ stage: Modified - name: Modified2184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2255\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2255\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -160641,7 +160641,7 @@ stage: Modified - name: Modified2185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -160649,7 +160649,7 @@ stage: Modified - name: Modified2186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160659,7 +160659,7 @@ stage: Modified - name: Modified2187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -160667,7 +160667,7 @@ stage: Modified - name: Modified2188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160677,7 +160677,7 @@ stage: Modified - name: Modified2189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -160685,7 +160685,7 @@ stage: Modified - name: Modified2190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160694,7 +160694,7 @@ stage: Modified - name: Modified2191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -160702,7 +160702,7 @@ stage: Modified - name: Modified2192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160711,7 +160711,7 @@ stage: Modified - name: Modified2193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -160719,7 +160719,7 @@ stage: Modified - name: Modified2194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160729,7 +160729,7 @@ stage: Modified - name: Modified2195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816922,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key", "arch": "[x64]", "timestamp": 1606816922, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -160737,7 +160737,7 @@ stage: Modified - name: Modified2196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816922,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816922, "attributes": @@ -160747,7 +160747,7 @@ stage: Modified - name: Modified2197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key", "arch": "[x64]", "timestamp": 1606816923, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -160755,7 +160755,7 @@ stage: Modified - name: Modified2198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -160764,7 +160764,7 @@ stage: Modified - name: Modified2199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770029,"checksum":"6322a1015771ba2269b79c79deceea097d46e841"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key", "arch": "[x64]", "timestamp": 1606816923, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -160772,7 +160772,7 @@ stage: Modified - name: Modified2200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -160781,7 +160781,7 @@ stage: Modified - name: Modified2201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2264\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2264\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -160791,7 +160791,7 @@ stage: Modified - name: Modified2202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2265\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2265\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -160801,7 +160801,7 @@ stage: Modified - name: Modified2203 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2266\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2266\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160810,7 +160810,7 @@ stage: Modified - name: Modified2204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2267\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2267\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160819,7 +160819,7 @@ stage: Modified - name: Modified2205 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2268\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2268\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -160829,7 +160829,7 @@ stage: Modified - name: Modified2206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2269\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2269\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -160839,7 +160839,7 @@ stage: Modified - name: Modified2207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2270\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2270\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -160848,7 +160848,7 @@ stage: Modified - name: Modified2208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2271\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2271\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -160857,7 +160857,7 @@ stage: Modified - name: Modified2209 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160878,7 +160878,7 @@ stage: Modified - name: Modified2210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -160888,7 +160888,7 @@ stage: Modified - name: Modified2211 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160909,7 +160909,7 @@ stage: Modified - name: Modified2212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -160919,7 +160919,7 @@ stage: Modified - name: Modified2213 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160940,7 +160940,7 @@ stage: Modified - name: Modified2214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160949,7 +160949,7 @@ stage: Modified - name: Modified2215 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -160970,7 +160970,7 @@ stage: Modified - name: Modified2216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -160979,7 +160979,7 @@ stage: Modified - name: Modified2217 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161000,7 +161000,7 @@ stage: Modified - name: Modified2218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -161010,7 +161010,7 @@ stage: Modified - name: Modified2219 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161031,7 +161031,7 @@ stage: Modified - name: Modified2220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -161041,7 +161041,7 @@ stage: Modified - name: Modified2221 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161062,7 +161062,7 @@ stage: Modified - name: Modified2222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -161071,7 +161071,7 @@ stage: Modified - name: Modified2223 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161092,7 +161092,7 @@ stage: Modified - name: Modified2224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -161101,7 +161101,7 @@ stage: Modified - name: Modified2225 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2280\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161122,7 +161122,7 @@ stage: Modified - name: Modified2226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2280\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2280\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -161132,7 +161132,7 @@ stage: Modified - name: Modified2227 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2281\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161153,7 +161153,7 @@ stage: Modified - name: Modified2228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2281\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2281\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -161163,7 +161163,7 @@ stage: Modified - name: Modified2229 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2282\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161184,7 +161184,7 @@ stage: Modified - name: Modified2230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2282\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2282\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161193,7 +161193,7 @@ stage: Modified - name: Modified2231 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2283\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161214,7 +161214,7 @@ stage: Modified - name: Modified2232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2283\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2283\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161223,7 +161223,7 @@ stage: Modified - name: Modified2233 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2284\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161244,7 +161244,7 @@ stage: Modified - name: Modified2234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2284\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2284\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -161254,7 +161254,7 @@ stage: Modified - name: Modified2235 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2285\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161275,7 +161275,7 @@ stage: Modified - name: Modified2236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2285\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2285\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -161285,7 +161285,7 @@ stage: Modified - name: Modified2237 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2286\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161306,7 +161306,7 @@ stage: Modified - name: Modified2238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2286\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2286\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -161315,7 +161315,7 @@ stage: Modified - name: Modified2239 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2287\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161336,7 +161336,7 @@ stage: Modified - name: Modified2240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2287\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2287\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -161345,14 +161345,14 @@ stage: Modified - name: Modified2241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key", "arch": "[x64]", "timestamp": 1606816923, "attributes": {"type": "registry_key", "mtime": 1606770030, "checksum": "28e48b834d452c91baa54040f69143ff1d05a8ad"}}' stage: Modified - name: Modified2242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -161362,14 +161362,14 @@ stage: Modified - name: Modified2243 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key", "arch": "[x64]", "timestamp": 1606816923, "attributes": {"type": "registry_key", "mtime": 1606770030, "checksum": "28e48b834d452c91baa54040f69143ff1d05a8ad"}}' stage: Modified - name: Modified2244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -161379,14 +161379,14 @@ stage: Modified - name: Modified2245 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key", "arch": "[x64]", "timestamp": 1606816923, "attributes": {"type": "registry_key", "mtime": 1606770030, "checksum": "28e48b834d452c91baa54040f69143ff1d05a8ad"}}' stage: Modified - name: Modified2246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161395,14 +161395,14 @@ stage: Modified - name: Modified2247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key", "arch": "[x64]", "timestamp": 1606816923, "attributes": {"type": "registry_key", "mtime": 1606770030, "checksum": "28e48b834d452c91baa54040f69143ff1d05a8ad"}}' stage: Modified - name: Modified2248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161411,14 +161411,14 @@ stage: Modified - name: Modified2249 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key", "arch": "[x64]", "timestamp": 1606816923, "attributes": {"type": "registry_key", "mtime": 1606770030, "checksum": "28e48b834d452c91baa54040f69143ff1d05a8ad"}}' stage: Modified - name: Modified2250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -161428,14 +161428,14 @@ stage: Modified - name: Modified2251 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816923,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key", "arch": "[x64]", "timestamp": 1606816923, "attributes": {"type": "registry_key", "mtime": 1606770030, "checksum": "28e48b834d452c91baa54040f69143ff1d05a8ad"}}' stage: Modified - name: Modified2252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816923,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816923, "attributes": @@ -161445,14 +161445,14 @@ stage: Modified - name: Modified2253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "mtime": 1606770030, "checksum": "28e48b834d452c91baa54040f69143ff1d05a8ad"}}' stage: Modified - name: Modified2254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -161461,14 +161461,14 @@ stage: Modified - name: Modified2255 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","mtime":1606770030,"checksum":"28e48b834d452c91baa54040f69143ff1d05a8ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "mtime": 1606770030, "checksum": "28e48b834d452c91baa54040f69143ff1d05a8ad"}}' stage: Modified - name: Modified2256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -161477,7 +161477,7 @@ stage: Modified - name: Modified2257 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2296\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2296\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161487,7 +161487,7 @@ stage: Modified - name: Modified2258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2297\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2297\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161497,7 +161497,7 @@ stage: Modified - name: Modified2259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2298\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2298\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161506,7 +161506,7 @@ stage: Modified - name: Modified2260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2299\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2299\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161515,7 +161515,7 @@ stage: Modified - name: Modified2261 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2300\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2300\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161525,7 +161525,7 @@ stage: Modified - name: Modified2262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2301\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2301\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161535,7 +161535,7 @@ stage: Modified - name: Modified2263 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2302\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2302\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -161544,7 +161544,7 @@ stage: Modified - name: Modified2264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2303\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"changed_attributes":["md5","sha1","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"a34cd82199fcba7b1ed05546a74f02d994625922"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2303\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -161553,7 +161553,7 @@ stage: Modified - name: Modified2265 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161576,7 +161576,7 @@ stage: Modified - name: Modified2266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161585,7 +161585,7 @@ stage: Modified - name: Modified2267 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161608,7 +161608,7 @@ stage: Modified - name: Modified2268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161617,7 +161617,7 @@ stage: Modified - name: Modified2269 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161640,7 +161640,7 @@ stage: Modified - name: Modified2270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161648,7 +161648,7 @@ stage: Modified - name: Modified2271 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161671,7 +161671,7 @@ stage: Modified - name: Modified2272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161679,7 +161679,7 @@ stage: Modified - name: Modified2273 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161702,7 +161702,7 @@ stage: Modified - name: Modified2274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161711,7 +161711,7 @@ stage: Modified - name: Modified2275 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161734,7 +161734,7 @@ stage: Modified - name: Modified2276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161743,7 +161743,7 @@ stage: Modified - name: Modified2277 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161766,7 +161766,7 @@ stage: Modified - name: Modified2278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161774,7 +161774,7 @@ stage: Modified - name: Modified2279 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161797,7 +161797,7 @@ stage: Modified - name: Modified2280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161805,7 +161805,7 @@ stage: Modified - name: Modified2281 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2312\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161828,7 +161828,7 @@ stage: Modified - name: Modified2282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2312\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2312\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161837,7 +161837,7 @@ stage: Modified - name: Modified2283 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2313\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161860,7 +161860,7 @@ stage: Modified - name: Modified2284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2313\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2313\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161869,7 +161869,7 @@ stage: Modified - name: Modified2285 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2314\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161892,7 +161892,7 @@ stage: Modified - name: Modified2286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2314\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2314\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161900,7 +161900,7 @@ stage: Modified - name: Modified2287 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2315\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161923,7 +161923,7 @@ stage: Modified - name: Modified2288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2315\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2315\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -161931,7 +161931,7 @@ stage: Modified - name: Modified2289 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2316\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161954,7 +161954,7 @@ stage: Modified - name: Modified2290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2316\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2316\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161963,7 +161963,7 @@ stage: Modified - name: Modified2291 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2317\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -161986,7 +161986,7 @@ stage: Modified - name: Modified2292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2317\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2317\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -161995,7 +161995,7 @@ stage: Modified - name: Modified2293 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2318\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162018,7 +162018,7 @@ stage: Modified - name: Modified2294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2318\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2318\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162026,7 +162026,7 @@ stage: Modified - name: Modified2295 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2319\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162049,7 +162049,7 @@ stage: Modified - name: Modified2296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2319\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2319\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162057,7 +162057,7 @@ stage: Modified - name: Modified2297 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162066,7 +162066,7 @@ stage: Modified - name: Modified2298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -162075,7 +162075,7 @@ stage: Modified - name: Modified2299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162084,7 +162084,7 @@ stage: Modified - name: Modified2300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -162093,7 +162093,7 @@ stage: Modified - name: Modified2301 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162102,7 +162102,7 @@ stage: Modified - name: Modified2302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162110,7 +162110,7 @@ stage: Modified - name: Modified2303 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162119,7 +162119,7 @@ stage: Modified - name: Modified2304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162127,7 +162127,7 @@ stage: Modified - name: Modified2305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162136,7 +162136,7 @@ stage: Modified - name: Modified2306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -162145,7 +162145,7 @@ stage: Modified - name: Modified2307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162154,7 +162154,7 @@ stage: Modified - name: Modified2308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -162163,7 +162163,7 @@ stage: Modified - name: Modified2309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162172,7 +162172,7 @@ stage: Modified - name: Modified2310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162180,7 +162180,7 @@ stage: Modified - name: Modified2311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770030,"checksum":"bbdf3a4e1b02f3f65628b7f8f85d50748da6b506"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162189,7 +162189,7 @@ stage: Modified - name: Modified2312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162197,7 +162197,7 @@ stage: Modified - name: Modified2313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162206,7 +162206,7 @@ stage: Modified - name: Modified2314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2328\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -162215,7 +162215,7 @@ stage: Modified - name: Modified2315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816924,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key", "arch": "[x64]", "timestamp": 1606816924, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162224,7 +162224,7 @@ stage: Modified - name: Modified2316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816924,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2329\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816924, "attributes": @@ -162233,7 +162233,7 @@ stage: Modified - name: Modified2317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162242,7 +162242,7 @@ stage: Modified - name: Modified2318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2330\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162250,7 +162250,7 @@ stage: Modified - name: Modified2319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162259,7 +162259,7 @@ stage: Modified - name: Modified2320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2331\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162267,7 +162267,7 @@ stage: Modified - name: Modified2321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162276,7 +162276,7 @@ stage: Modified - name: Modified2322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2332\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162285,7 +162285,7 @@ stage: Modified - name: Modified2323 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162294,7 +162294,7 @@ stage: Modified - name: Modified2324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2333\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162303,7 +162303,7 @@ stage: Modified - name: Modified2325 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162312,7 +162312,7 @@ stage: Modified - name: Modified2326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2334\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162320,7 +162320,7 @@ stage: Modified - name: Modified2327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162329,7 +162329,7 @@ stage: Modified - name: Modified2328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2335\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162337,7 +162337,7 @@ stage: Modified - name: Modified2329 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162359,7 +162359,7 @@ stage: Modified - name: Modified2330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162368,7 +162368,7 @@ stage: Modified - name: Modified2331 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162390,7 +162390,7 @@ stage: Modified - name: Modified2332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162399,7 +162399,7 @@ stage: Modified - name: Modified2333 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162421,7 +162421,7 @@ stage: Modified - name: Modified2334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162429,7 +162429,7 @@ stage: Modified - name: Modified2335 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162451,7 +162451,7 @@ stage: Modified - name: Modified2336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162459,7 +162459,7 @@ stage: Modified - name: Modified2337 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162481,7 +162481,7 @@ stage: Modified - name: Modified2338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162490,7 +162490,7 @@ stage: Modified - name: Modified2339 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162512,7 +162512,7 @@ stage: Modified - name: Modified2340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162521,7 +162521,7 @@ stage: Modified - name: Modified2341 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162543,7 +162543,7 @@ stage: Modified - name: Modified2342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162551,7 +162551,7 @@ stage: Modified - name: Modified2343 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162573,7 +162573,7 @@ stage: Modified - name: Modified2344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162581,7 +162581,7 @@ stage: Modified - name: Modified2345 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2344\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162603,7 +162603,7 @@ stage: Modified - name: Modified2346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2344\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2344\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162612,7 +162612,7 @@ stage: Modified - name: Modified2347 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2345\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162634,7 +162634,7 @@ stage: Modified - name: Modified2348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2345\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2345\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162643,7 +162643,7 @@ stage: Modified - name: Modified2349 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2346\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162665,7 +162665,7 @@ stage: Modified - name: Modified2350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2346\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2346\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162673,7 +162673,7 @@ stage: Modified - name: Modified2351 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2347\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162695,7 +162695,7 @@ stage: Modified - name: Modified2352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2347\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2347\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162703,7 +162703,7 @@ stage: Modified - name: Modified2353 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2348\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162725,7 +162725,7 @@ stage: Modified - name: Modified2354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2348\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2348\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162734,7 +162734,7 @@ stage: Modified - name: Modified2355 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2349\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162756,7 +162756,7 @@ stage: Modified - name: Modified2356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2349\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2349\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162765,7 +162765,7 @@ stage: Modified - name: Modified2357 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2350\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162787,7 +162787,7 @@ stage: Modified - name: Modified2358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2350\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2350\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162795,7 +162795,7 @@ stage: Modified - name: Modified2359 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2351\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -162817,7 +162817,7 @@ stage: Modified - name: Modified2360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2351\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2351\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162825,7 +162825,7 @@ stage: Modified - name: Modified2361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162833,7 +162833,7 @@ stage: Modified - name: Modified2362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162842,7 +162842,7 @@ stage: Modified - name: Modified2363 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162850,7 +162850,7 @@ stage: Modified - name: Modified2364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162859,7 +162859,7 @@ stage: Modified - name: Modified2365 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162867,7 +162867,7 @@ stage: Modified - name: Modified2366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162875,7 +162875,7 @@ stage: Modified - name: Modified2367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162883,7 +162883,7 @@ stage: Modified - name: Modified2368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162891,7 +162891,7 @@ stage: Modified - name: Modified2369 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162899,7 +162899,7 @@ stage: Modified - name: Modified2370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162908,7 +162908,7 @@ stage: Modified - name: Modified2371 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162916,7 +162916,7 @@ stage: Modified - name: Modified2372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162925,7 +162925,7 @@ stage: Modified - name: Modified2373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162933,7 +162933,7 @@ stage: Modified - name: Modified2374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162941,7 +162941,7 @@ stage: Modified - name: Modified2375 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770031,"checksum":"c3ec837183b51c49165aaa3f3cc3dab225a047f0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162949,7 +162949,7 @@ stage: Modified - name: Modified2376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -162957,7 +162957,7 @@ stage: Modified - name: Modified2377 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162965,7 +162965,7 @@ stage: Modified - name: Modified2378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2360\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162974,7 +162974,7 @@ stage: Modified - name: Modified2379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162982,7 +162982,7 @@ stage: Modified - name: Modified2380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2361\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -162991,7 +162991,7 @@ stage: Modified - name: Modified2381 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -162999,7 +162999,7 @@ stage: Modified - name: Modified2382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2362\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163007,7 +163007,7 @@ stage: Modified - name: Modified2383 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -163015,7 +163015,7 @@ stage: Modified - name: Modified2384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2363\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163023,7 +163023,7 @@ stage: Modified - name: Modified2385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816925,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key", "arch": "[x64]", "timestamp": 1606816925, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -163031,7 +163031,7 @@ stage: Modified - name: Modified2386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816925,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2364\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816925, "attributes": @@ -163040,7 +163040,7 @@ stage: Modified - name: Modified2387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key", "arch": "[x64]", "timestamp": 1606816926, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -163048,7 +163048,7 @@ stage: Modified - name: Modified2388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2365\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163057,7 +163057,7 @@ stage: Modified - name: Modified2389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key", "arch": "[x64]", "timestamp": 1606816926, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -163065,7 +163065,7 @@ stage: Modified - name: Modified2390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2366\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163073,7 +163073,7 @@ stage: Modified - name: Modified2391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key", "arch": "[x64]", "timestamp": 1606816926, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -163081,7 +163081,7 @@ stage: Modified - name: Modified2392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2367\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163089,7 +163089,7 @@ stage: Modified - name: Modified2393 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163111,7 +163111,7 @@ stage: Modified - name: Modified2394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163120,7 +163120,7 @@ stage: Modified - name: Modified2395 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163142,7 +163142,7 @@ stage: Modified - name: Modified2396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163151,7 +163151,7 @@ stage: Modified - name: Modified2397 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163173,7 +163173,7 @@ stage: Modified - name: Modified2398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163181,7 +163181,7 @@ stage: Modified - name: Modified2399 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163203,7 +163203,7 @@ stage: Modified - name: Modified2400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163211,7 +163211,7 @@ stage: Modified - name: Modified2401 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163233,7 +163233,7 @@ stage: Modified - name: Modified2402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163242,7 +163242,7 @@ stage: Modified - name: Modified2403 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163264,7 +163264,7 @@ stage: Modified - name: Modified2404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163273,7 +163273,7 @@ stage: Modified - name: Modified2405 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163295,7 +163295,7 @@ stage: Modified - name: Modified2406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163303,7 +163303,7 @@ stage: Modified - name: Modified2407 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163325,7 +163325,7 @@ stage: Modified - name: Modified2408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163333,7 +163333,7 @@ stage: Modified - name: Modified2409 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2376\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163355,7 +163355,7 @@ stage: Modified - name: Modified2410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2376\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2376\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163364,7 +163364,7 @@ stage: Modified - name: Modified2411 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2377\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163386,7 +163386,7 @@ stage: Modified - name: Modified2412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2377\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2377\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163395,7 +163395,7 @@ stage: Modified - name: Modified2413 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2378\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163417,7 +163417,7 @@ stage: Modified - name: Modified2414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2378\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2378\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163425,7 +163425,7 @@ stage: Modified - name: Modified2415 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2379\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163447,7 +163447,7 @@ stage: Modified - name: Modified2416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2379\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2379\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163455,7 +163455,7 @@ stage: Modified - name: Modified2417 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2380\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163477,7 +163477,7 @@ stage: Modified - name: Modified2418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2380\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2380\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163486,7 +163486,7 @@ stage: Modified - name: Modified2419 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2381\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163508,7 +163508,7 @@ stage: Modified - name: Modified2420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2381\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2381\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163517,7 +163517,7 @@ stage: Modified - name: Modified2421 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2382\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163539,7 +163539,7 @@ stage: Modified - name: Modified2422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2382\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2382\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163547,7 +163547,7 @@ stage: Modified - name: Modified2423 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2383\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163569,7 +163569,7 @@ stage: Modified - name: Modified2424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2383\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2383\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163577,7 +163577,7 @@ stage: Modified - name: Modified2425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key", "arch": "[x64]", "timestamp": 1606816926, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -163585,7 +163585,7 @@ stage: Modified - name: Modified2426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163594,7 +163594,7 @@ stage: Modified - name: Modified2427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key", "arch": "[x64]", "timestamp": 1606816926, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -163602,7 +163602,7 @@ stage: Modified - name: Modified2428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163611,7 +163611,7 @@ stage: Modified - name: Modified2429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key", "arch": "[x64]", "timestamp": 1606816926, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -163619,7 +163619,7 @@ stage: Modified - name: Modified2430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163627,7 +163627,7 @@ stage: Modified - name: Modified2431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key", "arch": "[x64]", "timestamp": 1606816926, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -163635,7 +163635,7 @@ stage: Modified - name: Modified2432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163643,7 +163643,7 @@ stage: Modified - name: Modified2433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key", "arch": "[x64]", "timestamp": 1606816926, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -163651,7 +163651,7 @@ stage: Modified - name: Modified2434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163660,7 +163660,7 @@ stage: Modified - name: Modified2435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key", "arch": "[x64]", "timestamp": 1606816926, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -163668,7 +163668,7 @@ stage: Modified - name: Modified2436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163677,7 +163677,7 @@ stage: Modified - name: Modified2437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key", "arch": "[x64]", "timestamp": 1606816926, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -163685,7 +163685,7 @@ stage: Modified - name: Modified2438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163693,7 +163693,7 @@ stage: Modified - name: Modified2439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770031,"checksum":"24d297317f8552712690e1c7388091573269e7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key", "arch": "[x64]", "timestamp": 1606816926, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -163701,7 +163701,7 @@ stage: Modified - name: Modified2440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163709,7 +163709,7 @@ stage: Modified - name: Modified2441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2392\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2392\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163718,7 +163718,7 @@ stage: Modified - name: Modified2442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2393\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2393\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163727,7 +163727,7 @@ stage: Modified - name: Modified2443 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2394\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2394\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163735,7 +163735,7 @@ stage: Modified - name: Modified2444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2395\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2395\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163743,7 +163743,7 @@ stage: Modified - name: Modified2445 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2396\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2396\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163752,7 +163752,7 @@ stage: Modified - name: Modified2446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2397\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2397\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163761,7 +163761,7 @@ stage: Modified - name: Modified2447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2398\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2398\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163769,7 +163769,7 @@ stage: Modified - name: Modified2448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2399\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2399\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163777,7 +163777,7 @@ stage: Modified - name: Modified2449 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816926,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163798,7 +163798,7 @@ stage: Modified - name: Modified2450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816926,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816926, "attributes": @@ -163807,7 +163807,7 @@ stage: Modified - name: Modified2451 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163828,7 +163828,7 @@ stage: Modified - name: Modified2452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -163837,7 +163837,7 @@ stage: Modified - name: Modified2453 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163858,7 +163858,7 @@ stage: Modified - name: Modified2454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163866,7 +163866,7 @@ stage: Modified - name: Modified2455 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163887,7 +163887,7 @@ stage: Modified - name: Modified2456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163895,7 +163895,7 @@ stage: Modified - name: Modified2457 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163916,7 +163916,7 @@ stage: Modified - name: Modified2458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -163925,7 +163925,7 @@ stage: Modified - name: Modified2459 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163946,7 +163946,7 @@ stage: Modified - name: Modified2460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -163955,7 +163955,7 @@ stage: Modified - name: Modified2461 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -163976,7 +163976,7 @@ stage: Modified - name: Modified2462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -163984,7 +163984,7 @@ stage: Modified - name: Modified2463 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164005,7 +164005,7 @@ stage: Modified - name: Modified2464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164013,7 +164013,7 @@ stage: Modified - name: Modified2465 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2408\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164034,7 +164034,7 @@ stage: Modified - name: Modified2466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2408\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2408\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164043,7 +164043,7 @@ stage: Modified - name: Modified2467 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2409\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164064,7 +164064,7 @@ stage: Modified - name: Modified2468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2409\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2409\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164073,7 +164073,7 @@ stage: Modified - name: Modified2469 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2410\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164094,7 +164094,7 @@ stage: Modified - name: Modified2470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2410\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2410\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164102,7 +164102,7 @@ stage: Modified - name: Modified2471 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2411\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164123,7 +164123,7 @@ stage: Modified - name: Modified2472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2411\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2411\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164131,7 +164131,7 @@ stage: Modified - name: Modified2473 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2412\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164152,7 +164152,7 @@ stage: Modified - name: Modified2474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2412\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2412\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164161,7 +164161,7 @@ stage: Modified - name: Modified2475 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2413\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164182,7 +164182,7 @@ stage: Modified - name: Modified2476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2413\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2413\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164191,7 +164191,7 @@ stage: Modified - name: Modified2477 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2414\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164212,7 +164212,7 @@ stage: Modified - name: Modified2478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2414\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2414\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164220,7 +164220,7 @@ stage: Modified - name: Modified2479 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2415\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164241,7 +164241,7 @@ stage: Modified - name: Modified2480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2415\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2415\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164249,14 +164249,14 @@ stage: Modified - name: Modified2481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key", "arch": "[x64]", "timestamp": 1606816927, "attributes": {"type": "registry_key", "mtime": 1606770032, "checksum": "35ab9276b8755f51bde1681b323f837984a82586"}}' stage: Modified - name: Modified2482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164265,14 +164265,14 @@ stage: Modified - name: Modified2483 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key", "arch": "[x64]", "timestamp": 1606816927, "attributes": {"type": "registry_key", "mtime": 1606770032, "checksum": "35ab9276b8755f51bde1681b323f837984a82586"}}' stage: Modified - name: Modified2484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164281,14 +164281,14 @@ stage: Modified - name: Modified2485 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key", "arch": "[x64]", "timestamp": 1606816927, "attributes": {"type": "registry_key", "mtime": 1606770032, "checksum": "35ab9276b8755f51bde1681b323f837984a82586"}}' stage: Modified - name: Modified2486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164296,14 +164296,14 @@ stage: Modified - name: Modified2487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key", "arch": "[x64]", "timestamp": 1606816927, "attributes": {"type": "registry_key", "mtime": 1606770032, "checksum": "35ab9276b8755f51bde1681b323f837984a82586"}}' stage: Modified - name: Modified2488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164311,14 +164311,14 @@ stage: Modified - name: Modified2489 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key", "arch": "[x64]", "timestamp": 1606816927, "attributes": {"type": "registry_key", "mtime": 1606770032, "checksum": "35ab9276b8755f51bde1681b323f837984a82586"}}' stage: Modified - name: Modified2490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164327,14 +164327,14 @@ stage: Modified - name: Modified2491 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key", "arch": "[x64]", "timestamp": 1606816927, "attributes": {"type": "registry_key", "mtime": 1606770032, "checksum": "35ab9276b8755f51bde1681b323f837984a82586"}}' stage: Modified - name: Modified2492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164343,14 +164343,14 @@ stage: Modified - name: Modified2493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key", "arch": "[x64]", "timestamp": 1606816927, "attributes": {"type": "registry_key", "mtime": 1606770032, "checksum": "35ab9276b8755f51bde1681b323f837984a82586"}}' stage: Modified - name: Modified2494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164358,14 +164358,14 @@ stage: Modified - name: Modified2495 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","mtime":1606770032,"checksum":"35ab9276b8755f51bde1681b323f837984a82586"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key", "arch": "[x64]", "timestamp": 1606816927, "attributes": {"type": "registry_key", "mtime": 1606770032, "checksum": "35ab9276b8755f51bde1681b323f837984a82586"}}' stage: Modified - name: Modified2496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164373,7 +164373,7 @@ stage: Modified - name: Modified2497 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2424\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2424\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164382,7 +164382,7 @@ stage: Modified - name: Modified2498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2425\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2425\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164391,7 +164391,7 @@ stage: Modified - name: Modified2499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2426\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2426\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164399,7 +164399,7 @@ stage: Modified - name: Modified2500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2427\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2427\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164407,7 +164407,7 @@ stage: Modified - name: Modified2501 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2428\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2428\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164416,7 +164416,7 @@ stage: Modified - name: Modified2502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2429\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2429\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164425,7 +164425,7 @@ stage: Modified - name: Modified2503 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2430\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2430\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164433,7 +164433,7 @@ stage: Modified - name: Modified2504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2431\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["size","md5","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2431\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164441,7 +164441,7 @@ stage: Modified - name: Modified2505 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164464,7 +164464,7 @@ stage: Modified - name: Modified2506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164473,7 +164473,7 @@ stage: Modified - name: Modified2507 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164496,7 +164496,7 @@ stage: Modified - name: Modified2508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164505,7 +164505,7 @@ stage: Modified - name: Modified2509 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164528,7 +164528,7 @@ stage: Modified - name: Modified2510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164536,7 +164536,7 @@ stage: Modified - name: Modified2511 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164559,7 +164559,7 @@ stage: Modified - name: Modified2512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164567,7 +164567,7 @@ stage: Modified - name: Modified2513 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816927,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164590,7 +164590,7 @@ stage: Modified - name: Modified2514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816927,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816927, "attributes": @@ -164599,7 +164599,7 @@ stage: Modified - name: Modified2515 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164622,7 +164622,7 @@ stage: Modified - name: Modified2516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -164631,7 +164631,7 @@ stage: Modified - name: Modified2517 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164654,7 +164654,7 @@ stage: Modified - name: Modified2518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -164662,7 +164662,7 @@ stage: Modified - name: Modified2519 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164685,7 +164685,7 @@ stage: Modified - name: Modified2520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -164693,7 +164693,7 @@ stage: Modified - name: Modified2521 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2440\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164716,7 +164716,7 @@ stage: Modified - name: Modified2522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2440\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2440\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -164725,7 +164725,7 @@ stage: Modified - name: Modified2523 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2441\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164748,7 +164748,7 @@ stage: Modified - name: Modified2524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2441\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2441\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -164757,7 +164757,7 @@ stage: Modified - name: Modified2525 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2442\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164780,7 +164780,7 @@ stage: Modified - name: Modified2526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2442\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2442\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164788,7 +164788,7 @@ stage: Modified - name: Modified2527 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2443\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164811,7 +164811,7 @@ stage: Modified - name: Modified2528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2443\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2443\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164819,7 +164819,7 @@ stage: Modified - name: Modified2529 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2444\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164842,7 +164842,7 @@ stage: Modified - name: Modified2530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2444\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2444\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -164851,7 +164851,7 @@ stage: Modified - name: Modified2531 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2445\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164874,7 +164874,7 @@ stage: Modified - name: Modified2532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2445\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2445\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -164883,7 +164883,7 @@ stage: Modified - name: Modified2533 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2446\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164906,7 +164906,7 @@ stage: Modified - name: Modified2534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2446\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2446\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -164914,7 +164914,7 @@ stage: Modified - name: Modified2535 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2447\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -164937,7 +164937,7 @@ stage: Modified - name: Modified2536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2447\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2447\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -164945,7 +164945,7 @@ stage: Modified - name: Modified2537 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -164954,7 +164954,7 @@ stage: Modified - name: Modified2538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -164963,7 +164963,7 @@ stage: Modified - name: Modified2539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -164972,7 +164972,7 @@ stage: Modified - name: Modified2540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -164981,7 +164981,7 @@ stage: Modified - name: Modified2541 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -164990,7 +164990,7 @@ stage: Modified - name: Modified2542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -164998,7 +164998,7 @@ stage: Modified - name: Modified2543 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165007,7 +165007,7 @@ stage: Modified - name: Modified2544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -165015,7 +165015,7 @@ stage: Modified - name: Modified2545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165024,7 +165024,7 @@ stage: Modified - name: Modified2546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -165033,7 +165033,7 @@ stage: Modified - name: Modified2547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165042,7 +165042,7 @@ stage: Modified - name: Modified2548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -165051,7 +165051,7 @@ stage: Modified - name: Modified2549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165060,7 +165060,7 @@ stage: Modified - name: Modified2550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165068,7 +165068,7 @@ stage: Modified - name: Modified2551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770033,"checksum":"877d64898d617568c8a0d74ad02038385ab5aefc"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165077,7 +165077,7 @@ stage: Modified - name: Modified2552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165085,7 +165085,7 @@ stage: Modified - name: Modified2553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165094,7 +165094,7 @@ stage: Modified - name: Modified2554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2456\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -165103,7 +165103,7 @@ stage: Modified - name: Modified2555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165112,7 +165112,7 @@ stage: Modified - name: Modified2556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2457\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -165121,7 +165121,7 @@ stage: Modified - name: Modified2557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165130,7 +165130,7 @@ stage: Modified - name: Modified2558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2458\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -165138,7 +165138,7 @@ stage: Modified - name: Modified2559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165147,7 +165147,7 @@ stage: Modified - name: Modified2560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2459\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -165155,7 +165155,7 @@ stage: Modified - name: Modified2561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165164,7 +165164,7 @@ stage: Modified - name: Modified2562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2460\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -165173,7 +165173,7 @@ stage: Modified - name: Modified2563 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165182,7 +165182,7 @@ stage: Modified - name: Modified2564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2461\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -165191,7 +165191,7 @@ stage: Modified - name: Modified2565 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165200,7 +165200,7 @@ stage: Modified - name: Modified2566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2462\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165208,7 +165208,7 @@ stage: Modified - name: Modified2567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key", "arch": "[x64]", "timestamp": 1606816928, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165217,7 +165217,7 @@ stage: Modified - name: Modified2568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2463\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165225,7 +165225,7 @@ stage: Modified - name: Modified2569 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165247,7 +165247,7 @@ stage: Modified - name: Modified2570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -165256,7 +165256,7 @@ stage: Modified - name: Modified2571 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165278,7 +165278,7 @@ stage: Modified - name: Modified2572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -165287,7 +165287,7 @@ stage: Modified - name: Modified2573 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165309,7 +165309,7 @@ stage: Modified - name: Modified2574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -165317,7 +165317,7 @@ stage: Modified - name: Modified2575 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165339,7 +165339,7 @@ stage: Modified - name: Modified2576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -165347,7 +165347,7 @@ stage: Modified - name: Modified2577 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165369,7 +165369,7 @@ stage: Modified - name: Modified2578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -165378,7 +165378,7 @@ stage: Modified - name: Modified2579 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816928,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165400,7 +165400,7 @@ stage: Modified - name: Modified2580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816928,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816928, "attributes": @@ -165409,7 +165409,7 @@ stage: Modified - name: Modified2581 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165431,7 +165431,7 @@ stage: Modified - name: Modified2582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165439,7 +165439,7 @@ stage: Modified - name: Modified2583 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165461,7 +165461,7 @@ stage: Modified - name: Modified2584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165469,7 +165469,7 @@ stage: Modified - name: Modified2585 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2472\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165491,7 +165491,7 @@ stage: Modified - name: Modified2586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2472\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2472\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165500,7 +165500,7 @@ stage: Modified - name: Modified2587 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2473\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165522,7 +165522,7 @@ stage: Modified - name: Modified2588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2473\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2473\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165531,7 +165531,7 @@ stage: Modified - name: Modified2589 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2474\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165553,7 +165553,7 @@ stage: Modified - name: Modified2590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2474\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2474\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -165561,7 +165561,7 @@ stage: Modified - name: Modified2591 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2475\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165583,7 +165583,7 @@ stage: Modified - name: Modified2592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2475\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2475\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -165591,7 +165591,7 @@ stage: Modified - name: Modified2593 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2476\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165613,7 +165613,7 @@ stage: Modified - name: Modified2594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2476\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2476\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165622,7 +165622,7 @@ stage: Modified - name: Modified2595 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2477\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165644,7 +165644,7 @@ stage: Modified - name: Modified2596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2477\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2477\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165653,7 +165653,7 @@ stage: Modified - name: Modified2597 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2478\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165675,7 +165675,7 @@ stage: Modified - name: Modified2598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2478\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2478\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165683,7 +165683,7 @@ stage: Modified - name: Modified2599 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2479\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165705,7 +165705,7 @@ stage: Modified - name: Modified2600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2479\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2479\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165713,7 +165713,7 @@ stage: Modified - name: Modified2601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165721,7 +165721,7 @@ stage: Modified - name: Modified2602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165730,7 +165730,7 @@ stage: Modified - name: Modified2603 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165738,7 +165738,7 @@ stage: Modified - name: Modified2604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165747,7 +165747,7 @@ stage: Modified - name: Modified2605 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165755,7 +165755,7 @@ stage: Modified - name: Modified2606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -165763,7 +165763,7 @@ stage: Modified - name: Modified2607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165771,7 +165771,7 @@ stage: Modified - name: Modified2608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -165779,7 +165779,7 @@ stage: Modified - name: Modified2609 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165787,7 +165787,7 @@ stage: Modified - name: Modified2610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165796,7 +165796,7 @@ stage: Modified - name: Modified2611 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165804,7 +165804,7 @@ stage: Modified - name: Modified2612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165813,7 +165813,7 @@ stage: Modified - name: Modified2613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165821,7 +165821,7 @@ stage: Modified - name: Modified2614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165829,7 +165829,7 @@ stage: Modified - name: Modified2615 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770033,"checksum":"ceed4e1e5678820ad7860c8a16cb8ab09e1aa7f6"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165837,7 +165837,7 @@ stage: Modified - name: Modified2616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165845,7 +165845,7 @@ stage: Modified - name: Modified2617 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165853,7 +165853,7 @@ stage: Modified - name: Modified2618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2488\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165862,7 +165862,7 @@ stage: Modified - name: Modified2619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165870,7 +165870,7 @@ stage: Modified - name: Modified2620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2489\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165879,7 +165879,7 @@ stage: Modified - name: Modified2621 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165887,7 +165887,7 @@ stage: Modified - name: Modified2622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2490\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -165895,7 +165895,7 @@ stage: Modified - name: Modified2623 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165903,7 +165903,7 @@ stage: Modified - name: Modified2624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2491\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -165911,7 +165911,7 @@ stage: Modified - name: Modified2625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165919,7 +165919,7 @@ stage: Modified - name: Modified2626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2492\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165928,7 +165928,7 @@ stage: Modified - name: Modified2627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165936,7 +165936,7 @@ stage: Modified - name: Modified2628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2493\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -165945,7 +165945,7 @@ stage: Modified - name: Modified2629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165953,7 +165953,7 @@ stage: Modified - name: Modified2630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2494\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165961,7 +165961,7 @@ stage: Modified - name: Modified2631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key", "arch": "[x64]", "timestamp": 1606816929, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -165969,7 +165969,7 @@ stage: Modified - name: Modified2632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2495\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -165977,7 +165977,7 @@ stage: Modified - name: Modified2633 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -165999,7 +165999,7 @@ stage: Modified - name: Modified2634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -166008,7 +166008,7 @@ stage: Modified - name: Modified2635 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166030,7 +166030,7 @@ stage: Modified - name: Modified2636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -166039,7 +166039,7 @@ stage: Modified - name: Modified2637 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166061,7 +166061,7 @@ stage: Modified - name: Modified2638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -166069,7 +166069,7 @@ stage: Modified - name: Modified2639 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166091,7 +166091,7 @@ stage: Modified - name: Modified2640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -166099,7 +166099,7 @@ stage: Modified - name: Modified2641 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166121,7 +166121,7 @@ stage: Modified - name: Modified2642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -166130,7 +166130,7 @@ stage: Modified - name: Modified2643 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166152,7 +166152,7 @@ stage: Modified - name: Modified2644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -166161,7 +166161,7 @@ stage: Modified - name: Modified2645 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166183,7 +166183,7 @@ stage: Modified - name: Modified2646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -166191,7 +166191,7 @@ stage: Modified - name: Modified2647 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166213,7 +166213,7 @@ stage: Modified - name: Modified2648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -166221,7 +166221,7 @@ stage: Modified - name: Modified2649 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2504\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166243,7 +166243,7 @@ stage: Modified - name: Modified2650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2504\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2504\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -166252,7 +166252,7 @@ stage: Modified - name: Modified2651 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2505\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166274,7 +166274,7 @@ stage: Modified - name: Modified2652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2505\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2505\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -166283,7 +166283,7 @@ stage: Modified - name: Modified2653 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2506\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166305,7 +166305,7 @@ stage: Modified - name: Modified2654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2506\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2506\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -166313,7 +166313,7 @@ stage: Modified - name: Modified2655 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2507\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166335,7 +166335,7 @@ stage: Modified - name: Modified2656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2507\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2507\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -166343,7 +166343,7 @@ stage: Modified - name: Modified2657 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2508\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816929,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166365,7 +166365,7 @@ stage: Modified - name: Modified2658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2508\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816929,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2508\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816929, "attributes": @@ -166374,7 +166374,7 @@ stage: Modified - name: Modified2659 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2509\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166396,7 +166396,7 @@ stage: Modified - name: Modified2660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2509\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2509\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166405,7 +166405,7 @@ stage: Modified - name: Modified2661 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2510\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166427,7 +166427,7 @@ stage: Modified - name: Modified2662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2510\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2510\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -166435,7 +166435,7 @@ stage: Modified - name: Modified2663 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2511\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166457,7 +166457,7 @@ stage: Modified - name: Modified2664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2511\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2511\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -166465,7 +166465,7 @@ stage: Modified - name: Modified2665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key", "arch": "[x64]", "timestamp": 1606816930, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -166473,7 +166473,7 @@ stage: Modified - name: Modified2666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166482,7 +166482,7 @@ stage: Modified - name: Modified2667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key", "arch": "[x64]", "timestamp": 1606816930, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -166490,7 +166490,7 @@ stage: Modified - name: Modified2668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166499,7 +166499,7 @@ stage: Modified - name: Modified2669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key", "arch": "[x64]", "timestamp": 1606816930, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -166507,7 +166507,7 @@ stage: Modified - name: Modified2670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -166515,7 +166515,7 @@ stage: Modified - name: Modified2671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key", "arch": "[x64]", "timestamp": 1606816930, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -166523,7 +166523,7 @@ stage: Modified - name: Modified2672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -166531,7 +166531,7 @@ stage: Modified - name: Modified2673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key", "arch": "[x64]", "timestamp": 1606816930, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -166539,7 +166539,7 @@ stage: Modified - name: Modified2674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166548,7 +166548,7 @@ stage: Modified - name: Modified2675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key", "arch": "[x64]", "timestamp": 1606816930, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -166556,7 +166556,7 @@ stage: Modified - name: Modified2676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166565,7 +166565,7 @@ stage: Modified - name: Modified2677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key", "arch": "[x64]", "timestamp": 1606816930, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -166573,7 +166573,7 @@ stage: Modified - name: Modified2678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -166581,7 +166581,7 @@ stage: Modified - name: Modified2679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770034,"checksum":"8e4c0138574b2058fea9d7bc953d5670a86b7bfe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key", "arch": "[x64]", "timestamp": 1606816930, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -166589,7 +166589,7 @@ stage: Modified - name: Modified2680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -166597,7 +166597,7 @@ stage: Modified - name: Modified2681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2520\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2520\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166606,7 +166606,7 @@ stage: Modified - name: Modified2682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2521\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2521\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166615,7 +166615,7 @@ stage: Modified - name: Modified2683 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2522\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2522\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -166623,7 +166623,7 @@ stage: Modified - name: Modified2684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2523\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2523\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -166631,7 +166631,7 @@ stage: Modified - name: Modified2685 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2524\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2524\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166640,7 +166640,7 @@ stage: Modified - name: Modified2686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2525\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2525\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166649,7 +166649,7 @@ stage: Modified - name: Modified2687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2526\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2526\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -166657,7 +166657,7 @@ stage: Modified - name: Modified2688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2527\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2527\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -166665,7 +166665,7 @@ stage: Modified - name: Modified2689 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166686,7 +166686,7 @@ stage: Modified - name: Modified2690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166695,7 +166695,7 @@ stage: Modified - name: Modified2691 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166716,7 +166716,7 @@ stage: Modified - name: Modified2692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166725,7 +166725,7 @@ stage: Modified - name: Modified2693 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166746,7 +166746,7 @@ stage: Modified - name: Modified2694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -166754,7 +166754,7 @@ stage: Modified - name: Modified2695 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166775,7 +166775,7 @@ stage: Modified - name: Modified2696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -166783,7 +166783,7 @@ stage: Modified - name: Modified2697 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166804,7 +166804,7 @@ stage: Modified - name: Modified2698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166813,7 +166813,7 @@ stage: Modified - name: Modified2699 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166834,7 +166834,7 @@ stage: Modified - name: Modified2700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166843,7 +166843,7 @@ stage: Modified - name: Modified2701 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166864,7 +166864,7 @@ stage: Modified - name: Modified2702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -166872,7 +166872,7 @@ stage: Modified - name: Modified2703 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166893,7 +166893,7 @@ stage: Modified - name: Modified2704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -166901,7 +166901,7 @@ stage: Modified - name: Modified2705 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2536\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166922,7 +166922,7 @@ stage: Modified - name: Modified2706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2536\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2536\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166931,7 +166931,7 @@ stage: Modified - name: Modified2707 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2537\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166952,7 +166952,7 @@ stage: Modified - name: Modified2708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2537\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2537\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -166961,7 +166961,7 @@ stage: Modified - name: Modified2709 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2538\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -166982,7 +166982,7 @@ stage: Modified - name: Modified2710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2538\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2538\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -166990,7 +166990,7 @@ stage: Modified - name: Modified2711 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2539\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167011,7 +167011,7 @@ stage: Modified - name: Modified2712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2539\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2539\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -167019,7 +167019,7 @@ stage: Modified - name: Modified2713 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2540\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167040,7 +167040,7 @@ stage: Modified - name: Modified2714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2540\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2540\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -167049,7 +167049,7 @@ stage: Modified - name: Modified2715 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2541\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167070,7 +167070,7 @@ stage: Modified - name: Modified2716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2541\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2541\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -167079,7 +167079,7 @@ stage: Modified - name: Modified2717 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2542\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167100,7 +167100,7 @@ stage: Modified - name: Modified2718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2542\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2542\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -167108,7 +167108,7 @@ stage: Modified - name: Modified2719 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2543\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167129,7 +167129,7 @@ stage: Modified - name: Modified2720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2543\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2543\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -167137,14 +167137,14 @@ stage: Modified - name: Modified2721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816930,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key", "arch": "[x64]", "timestamp": 1606816930, "attributes": {"type": "registry_key", "mtime": 1606770034, "checksum": "3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"}}' stage: Modified - name: Modified2722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816930,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816930, "attributes": @@ -167153,14 +167153,14 @@ stage: Modified - name: Modified2723 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "mtime": 1606770034, "checksum": "3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"}}' stage: Modified - name: Modified2724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167169,14 +167169,14 @@ stage: Modified - name: Modified2725 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "mtime": 1606770034, "checksum": "3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"}}' stage: Modified - name: Modified2726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -167184,14 +167184,14 @@ stage: Modified - name: Modified2727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "mtime": 1606770034, "checksum": "3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"}}' stage: Modified - name: Modified2728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -167199,14 +167199,14 @@ stage: Modified - name: Modified2729 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "mtime": 1606770034, "checksum": "3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"}}' stage: Modified - name: Modified2730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167215,14 +167215,14 @@ stage: Modified - name: Modified2731 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "mtime": 1606770034, "checksum": "3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"}}' stage: Modified - name: Modified2732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167231,14 +167231,14 @@ stage: Modified - name: Modified2733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "mtime": 1606770034, "checksum": "3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"}}' stage: Modified - name: Modified2734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -167246,14 +167246,14 @@ stage: Modified - name: Modified2735 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","mtime":1606770034,"checksum":"3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "mtime": 1606770034, "checksum": "3886ea94aab1dbe4b9687d8b4cfb3f3fab74db0b"}}' stage: Modified - name: Modified2736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -167261,7 +167261,7 @@ stage: Modified - name: Modified2737 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2552\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2552\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167270,7 +167270,7 @@ stage: Modified - name: Modified2738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2553\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2553\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167279,7 +167279,7 @@ stage: Modified - name: Modified2739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2554\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2554\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -167287,7 +167287,7 @@ stage: Modified - name: Modified2740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2555\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2555\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -167295,7 +167295,7 @@ stage: Modified - name: Modified2741 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2556\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2556\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167304,7 +167304,7 @@ stage: Modified - name: Modified2742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2557\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2557\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167313,7 +167313,7 @@ stage: Modified - name: Modified2743 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2558\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2558\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -167321,7 +167321,7 @@ stage: Modified - name: Modified2744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2559\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"changed_attributes":["md5","sha1"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"bf7cc584715b5433c73bc14b6e0cb76db048fdfc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2559\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha1": @@ -167329,7 +167329,7 @@ stage: Modified - name: Modified2745 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167352,7 +167352,7 @@ stage: Modified - name: Modified2746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167362,7 +167362,7 @@ stage: Modified - name: Modified2747 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167385,7 +167385,7 @@ stage: Modified - name: Modified2748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167395,7 +167395,7 @@ stage: Modified - name: Modified2749 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167418,7 +167418,7 @@ stage: Modified - name: Modified2750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167427,7 +167427,7 @@ stage: Modified - name: Modified2751 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167450,7 +167450,7 @@ stage: Modified - name: Modified2752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167459,7 +167459,7 @@ stage: Modified - name: Modified2753 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167482,7 +167482,7 @@ stage: Modified - name: Modified2754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167492,7 +167492,7 @@ stage: Modified - name: Modified2755 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167515,7 +167515,7 @@ stage: Modified - name: Modified2756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167525,7 +167525,7 @@ stage: Modified - name: Modified2757 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167548,7 +167548,7 @@ stage: Modified - name: Modified2758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167557,7 +167557,7 @@ stage: Modified - name: Modified2759 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167580,7 +167580,7 @@ stage: Modified - name: Modified2760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167589,7 +167589,7 @@ stage: Modified - name: Modified2761 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2568\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167612,7 +167612,7 @@ stage: Modified - name: Modified2762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2568\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2568\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167622,7 +167622,7 @@ stage: Modified - name: Modified2763 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2569\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167645,7 +167645,7 @@ stage: Modified - name: Modified2764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2569\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2569\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167655,7 +167655,7 @@ stage: Modified - name: Modified2765 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2570\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167678,7 +167678,7 @@ stage: Modified - name: Modified2766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2570\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2570\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167687,7 +167687,7 @@ stage: Modified - name: Modified2767 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2571\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167710,7 +167710,7 @@ stage: Modified - name: Modified2768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2571\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2571\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167719,7 +167719,7 @@ stage: Modified - name: Modified2769 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2572\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167742,7 +167742,7 @@ stage: Modified - name: Modified2770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2572\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2572\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167752,7 +167752,7 @@ stage: Modified - name: Modified2771 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2573\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167775,7 +167775,7 @@ stage: Modified - name: Modified2772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2573\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2573\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167785,7 +167785,7 @@ stage: Modified - name: Modified2773 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2574\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167808,7 +167808,7 @@ stage: Modified - name: Modified2774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2574\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2574\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167817,7 +167817,7 @@ stage: Modified - name: Modified2775 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2575\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -167840,7 +167840,7 @@ stage: Modified - name: Modified2776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2575\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2575\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167849,7 +167849,7 @@ stage: Modified - name: Modified2777 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -167858,7 +167858,7 @@ stage: Modified - name: Modified2778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167868,7 +167868,7 @@ stage: Modified - name: Modified2779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -167877,7 +167877,7 @@ stage: Modified - name: Modified2780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167887,7 +167887,7 @@ stage: Modified - name: Modified2781 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -167896,7 +167896,7 @@ stage: Modified - name: Modified2782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167905,7 +167905,7 @@ stage: Modified - name: Modified2783 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -167914,7 +167914,7 @@ stage: Modified - name: Modified2784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167923,7 +167923,7 @@ stage: Modified - name: Modified2785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -167932,7 +167932,7 @@ stage: Modified - name: Modified2786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167942,7 +167942,7 @@ stage: Modified - name: Modified2787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -167951,7 +167951,7 @@ stage: Modified - name: Modified2788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -167961,7 +167961,7 @@ stage: Modified - name: Modified2789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -167970,7 +167970,7 @@ stage: Modified - name: Modified2790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167979,7 +167979,7 @@ stage: Modified - name: Modified2791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770035,"checksum":"01071dfd2eb28df0f2d694f284bbf8c4f74f0c15"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -167988,7 +167988,7 @@ stage: Modified - name: Modified2792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -167997,7 +167997,7 @@ stage: Modified - name: Modified2793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816931,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key", "arch": "[x64]", "timestamp": 1606816931, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168006,7 +168006,7 @@ stage: Modified - name: Modified2794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816931,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2584\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816931, "attributes": @@ -168016,7 +168016,7 @@ stage: Modified - name: Modified2795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168025,7 +168025,7 @@ stage: Modified - name: Modified2796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2585\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168035,7 +168035,7 @@ stage: Modified - name: Modified2797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168044,7 +168044,7 @@ stage: Modified - name: Modified2798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2586\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168053,7 +168053,7 @@ stage: Modified - name: Modified2799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168062,7 +168062,7 @@ stage: Modified - name: Modified2800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2587\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168071,7 +168071,7 @@ stage: Modified - name: Modified2801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168080,7 +168080,7 @@ stage: Modified - name: Modified2802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2588\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168090,7 +168090,7 @@ stage: Modified - name: Modified2803 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168099,7 +168099,7 @@ stage: Modified - name: Modified2804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2589\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168109,7 +168109,7 @@ stage: Modified - name: Modified2805 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168118,7 +168118,7 @@ stage: Modified - name: Modified2806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2590\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168127,7 +168127,7 @@ stage: Modified - name: Modified2807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168136,7 +168136,7 @@ stage: Modified - name: Modified2808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2591\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168145,7 +168145,7 @@ stage: Modified - name: Modified2809 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168167,7 +168167,7 @@ stage: Modified - name: Modified2810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168177,7 +168177,7 @@ stage: Modified - name: Modified2811 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168199,7 +168199,7 @@ stage: Modified - name: Modified2812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168209,7 +168209,7 @@ stage: Modified - name: Modified2813 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168231,7 +168231,7 @@ stage: Modified - name: Modified2814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168240,7 +168240,7 @@ stage: Modified - name: Modified2815 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168262,7 +168262,7 @@ stage: Modified - name: Modified2816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168271,7 +168271,7 @@ stage: Modified - name: Modified2817 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168293,7 +168293,7 @@ stage: Modified - name: Modified2818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168303,7 +168303,7 @@ stage: Modified - name: Modified2819 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168325,7 +168325,7 @@ stage: Modified - name: Modified2820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168335,7 +168335,7 @@ stage: Modified - name: Modified2821 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168357,7 +168357,7 @@ stage: Modified - name: Modified2822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168366,7 +168366,7 @@ stage: Modified - name: Modified2823 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168388,7 +168388,7 @@ stage: Modified - name: Modified2824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168397,7 +168397,7 @@ stage: Modified - name: Modified2825 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2600\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168419,7 +168419,7 @@ stage: Modified - name: Modified2826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2600\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2600\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168429,7 +168429,7 @@ stage: Modified - name: Modified2827 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2601\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168451,7 +168451,7 @@ stage: Modified - name: Modified2828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2601\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2601\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168461,7 +168461,7 @@ stage: Modified - name: Modified2829 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2602\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168483,7 +168483,7 @@ stage: Modified - name: Modified2830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2602\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2602\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168492,7 +168492,7 @@ stage: Modified - name: Modified2831 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2603\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168514,7 +168514,7 @@ stage: Modified - name: Modified2832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2603\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2603\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168523,7 +168523,7 @@ stage: Modified - name: Modified2833 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2604\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168545,7 +168545,7 @@ stage: Modified - name: Modified2834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2604\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2604\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168555,7 +168555,7 @@ stage: Modified - name: Modified2835 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2605\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168577,7 +168577,7 @@ stage: Modified - name: Modified2836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2605\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2605\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168587,7 +168587,7 @@ stage: Modified - name: Modified2837 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2606\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168609,7 +168609,7 @@ stage: Modified - name: Modified2838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2606\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2606\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168618,7 +168618,7 @@ stage: Modified - name: Modified2839 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2607\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168640,7 +168640,7 @@ stage: Modified - name: Modified2840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2607\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2607\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168649,7 +168649,7 @@ stage: Modified - name: Modified2841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168657,7 +168657,7 @@ stage: Modified - name: Modified2842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168667,7 +168667,7 @@ stage: Modified - name: Modified2843 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168675,7 +168675,7 @@ stage: Modified - name: Modified2844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168685,7 +168685,7 @@ stage: Modified - name: Modified2845 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168693,7 +168693,7 @@ stage: Modified - name: Modified2846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168702,7 +168702,7 @@ stage: Modified - name: Modified2847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168710,7 +168710,7 @@ stage: Modified - name: Modified2848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168719,7 +168719,7 @@ stage: Modified - name: Modified2849 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168727,7 +168727,7 @@ stage: Modified - name: Modified2850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168737,7 +168737,7 @@ stage: Modified - name: Modified2851 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168745,7 +168745,7 @@ stage: Modified - name: Modified2852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168755,7 +168755,7 @@ stage: Modified - name: Modified2853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168763,7 +168763,7 @@ stage: Modified - name: Modified2854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168772,7 +168772,7 @@ stage: Modified - name: Modified2855 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770035,"checksum":"42219f9ea324613fadb738abf8b5bba978de7015"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168780,7 +168780,7 @@ stage: Modified - name: Modified2856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168789,7 +168789,7 @@ stage: Modified - name: Modified2857 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168797,7 +168797,7 @@ stage: Modified - name: Modified2858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2616\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168807,7 +168807,7 @@ stage: Modified - name: Modified2859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168815,7 +168815,7 @@ stage: Modified - name: Modified2860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2617\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168825,7 +168825,7 @@ stage: Modified - name: Modified2861 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168833,7 +168833,7 @@ stage: Modified - name: Modified2862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2618\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168842,7 +168842,7 @@ stage: Modified - name: Modified2863 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168850,7 +168850,7 @@ stage: Modified - name: Modified2864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2619\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168859,7 +168859,7 @@ stage: Modified - name: Modified2865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168867,7 +168867,7 @@ stage: Modified - name: Modified2866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2620\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168877,7 +168877,7 @@ stage: Modified - name: Modified2867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816932,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key", "arch": "[x64]", "timestamp": 1606816932, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168885,7 +168885,7 @@ stage: Modified - name: Modified2868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816932,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2621\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816932, "attributes": @@ -168895,7 +168895,7 @@ stage: Modified - name: Modified2869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key", "arch": "[x64]", "timestamp": 1606816933, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168903,7 +168903,7 @@ stage: Modified - name: Modified2870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2622\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168912,7 +168912,7 @@ stage: Modified - name: Modified2871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key", "arch": "[x64]", "timestamp": 1606816933, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -168920,7 +168920,7 @@ stage: Modified - name: Modified2872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2623\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -168929,7 +168929,7 @@ stage: Modified - name: Modified2873 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168951,7 +168951,7 @@ stage: Modified - name: Modified2874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -168961,7 +168961,7 @@ stage: Modified - name: Modified2875 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -168983,7 +168983,7 @@ stage: Modified - name: Modified2876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -168993,7 +168993,7 @@ stage: Modified - name: Modified2877 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169015,7 +169015,7 @@ stage: Modified - name: Modified2878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169024,7 +169024,7 @@ stage: Modified - name: Modified2879 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169046,7 +169046,7 @@ stage: Modified - name: Modified2880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169055,7 +169055,7 @@ stage: Modified - name: Modified2881 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169077,7 +169077,7 @@ stage: Modified - name: Modified2882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169087,7 +169087,7 @@ stage: Modified - name: Modified2883 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169109,7 +169109,7 @@ stage: Modified - name: Modified2884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169119,7 +169119,7 @@ stage: Modified - name: Modified2885 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169141,7 +169141,7 @@ stage: Modified - name: Modified2886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169150,7 +169150,7 @@ stage: Modified - name: Modified2887 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169172,7 +169172,7 @@ stage: Modified - name: Modified2888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169181,7 +169181,7 @@ stage: Modified - name: Modified2889 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2632\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169203,7 +169203,7 @@ stage: Modified - name: Modified2890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2632\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2632\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169213,7 +169213,7 @@ stage: Modified - name: Modified2891 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2633\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169235,7 +169235,7 @@ stage: Modified - name: Modified2892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2633\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2633\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169245,7 +169245,7 @@ stage: Modified - name: Modified2893 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2634\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169267,7 +169267,7 @@ stage: Modified - name: Modified2894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2634\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2634\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169276,7 +169276,7 @@ stage: Modified - name: Modified2895 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2635\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169298,7 +169298,7 @@ stage: Modified - name: Modified2896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2635\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2635\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169307,7 +169307,7 @@ stage: Modified - name: Modified2897 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2636\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169329,7 +169329,7 @@ stage: Modified - name: Modified2898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2636\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2636\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169339,7 +169339,7 @@ stage: Modified - name: Modified2899 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2637\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169361,7 +169361,7 @@ stage: Modified - name: Modified2900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2637\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2637\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169371,7 +169371,7 @@ stage: Modified - name: Modified2901 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2638\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169393,7 +169393,7 @@ stage: Modified - name: Modified2902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2638\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2638\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169402,7 +169402,7 @@ stage: Modified - name: Modified2903 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2639\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169424,7 +169424,7 @@ stage: Modified - name: Modified2904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2639\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2639\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169433,7 +169433,7 @@ stage: Modified - name: Modified2905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key", "arch": "[x64]", "timestamp": 1606816933, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -169441,7 +169441,7 @@ stage: Modified - name: Modified2906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169451,7 +169451,7 @@ stage: Modified - name: Modified2907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key", "arch": "[x64]", "timestamp": 1606816933, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -169459,7 +169459,7 @@ stage: Modified - name: Modified2908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169469,7 +169469,7 @@ stage: Modified - name: Modified2909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key", "arch": "[x64]", "timestamp": 1606816933, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -169477,7 +169477,7 @@ stage: Modified - name: Modified2910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169486,7 +169486,7 @@ stage: Modified - name: Modified2911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key", "arch": "[x64]", "timestamp": 1606816933, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -169494,7 +169494,7 @@ stage: Modified - name: Modified2912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169503,7 +169503,7 @@ stage: Modified - name: Modified2913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key", "arch": "[x64]", "timestamp": 1606816933, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -169511,7 +169511,7 @@ stage: Modified - name: Modified2914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169521,7 +169521,7 @@ stage: Modified - name: Modified2915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key", "arch": "[x64]", "timestamp": 1606816933, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -169529,7 +169529,7 @@ stage: Modified - name: Modified2916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169539,7 +169539,7 @@ stage: Modified - name: Modified2917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key", "arch": "[x64]", "timestamp": 1606816933, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -169547,7 +169547,7 @@ stage: Modified - name: Modified2918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169556,7 +169556,7 @@ stage: Modified - name: Modified2919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770036,"checksum":"034e3986a177129c0095fa823df172213262e7bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key", "arch": "[x64]", "timestamp": 1606816933, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -169564,7 +169564,7 @@ stage: Modified - name: Modified2920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169573,7 +169573,7 @@ stage: Modified - name: Modified2921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2648\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2648\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169583,7 +169583,7 @@ stage: Modified - name: Modified2922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2649\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2649\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169593,7 +169593,7 @@ stage: Modified - name: Modified2923 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2650\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2650\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169602,7 +169602,7 @@ stage: Modified - name: Modified2924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2651\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2651\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169611,7 +169611,7 @@ stage: Modified - name: Modified2925 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2652\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2652\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169621,7 +169621,7 @@ stage: Modified - name: Modified2926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2653\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2653\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169631,7 +169631,7 @@ stage: Modified - name: Modified2927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2654\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2654\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169640,7 +169640,7 @@ stage: Modified - name: Modified2928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2655\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2655\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169649,7 +169649,7 @@ stage: Modified - name: Modified2929 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169670,7 +169670,7 @@ stage: Modified - name: Modified2930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169680,7 +169680,7 @@ stage: Modified - name: Modified2931 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816933,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169701,7 +169701,7 @@ stage: Modified - name: Modified2932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816933,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816933, "attributes": @@ -169711,7 +169711,7 @@ stage: Modified - name: Modified2933 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169732,7 +169732,7 @@ stage: Modified - name: Modified2934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169741,7 +169741,7 @@ stage: Modified - name: Modified2935 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169762,7 +169762,7 @@ stage: Modified - name: Modified2936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169771,7 +169771,7 @@ stage: Modified - name: Modified2937 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169792,7 +169792,7 @@ stage: Modified - name: Modified2938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -169802,7 +169802,7 @@ stage: Modified - name: Modified2939 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169823,7 +169823,7 @@ stage: Modified - name: Modified2940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -169833,7 +169833,7 @@ stage: Modified - name: Modified2941 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169854,7 +169854,7 @@ stage: Modified - name: Modified2942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169863,7 +169863,7 @@ stage: Modified - name: Modified2943 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169884,7 +169884,7 @@ stage: Modified - name: Modified2944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169893,7 +169893,7 @@ stage: Modified - name: Modified2945 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2664\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169914,7 +169914,7 @@ stage: Modified - name: Modified2946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2664\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2664\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -169924,7 +169924,7 @@ stage: Modified - name: Modified2947 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2665\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169945,7 +169945,7 @@ stage: Modified - name: Modified2948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2665\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2665\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -169955,7 +169955,7 @@ stage: Modified - name: Modified2949 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2666\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -169976,7 +169976,7 @@ stage: Modified - name: Modified2950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2666\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2666\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -169985,7 +169985,7 @@ stage: Modified - name: Modified2951 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2667\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170006,7 +170006,7 @@ stage: Modified - name: Modified2952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2667\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2667\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170015,7 +170015,7 @@ stage: Modified - name: Modified2953 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2668\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170036,7 +170036,7 @@ stage: Modified - name: Modified2954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2668\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2668\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170046,7 +170046,7 @@ stage: Modified - name: Modified2955 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2669\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170067,7 +170067,7 @@ stage: Modified - name: Modified2956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2669\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2669\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170077,7 +170077,7 @@ stage: Modified - name: Modified2957 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2670\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170098,7 +170098,7 @@ stage: Modified - name: Modified2958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2670\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2670\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170107,7 +170107,7 @@ stage: Modified - name: Modified2959 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2671\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170128,7 +170128,7 @@ stage: Modified - name: Modified2960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2671\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2671\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170137,14 +170137,14 @@ stage: Modified - name: Modified2961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770036,"checksum":"a2da8f97629cf2315f5f8a80f069beaa7984adc5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770036,"checksum":"a2da8f97629cf2315f5f8a80f069beaa7984adc5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key", "arch": "[x64]", "timestamp": 1606816934, "attributes": {"type": "registry_key", "mtime": 1606770036, "checksum": "a2da8f97629cf2315f5f8a80f069beaa7984adc5"}}' stage: Modified - name: Modified2962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170154,14 +170154,14 @@ stage: Modified - name: Modified2963 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770036,"checksum":"a2da8f97629cf2315f5f8a80f069beaa7984adc5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770036,"checksum":"a2da8f97629cf2315f5f8a80f069beaa7984adc5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key", "arch": "[x64]", "timestamp": 1606816934, "attributes": {"type": "registry_key", "mtime": 1606770036, "checksum": "a2da8f97629cf2315f5f8a80f069beaa7984adc5"}}' stage: Modified - name: Modified2964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170171,14 +170171,14 @@ stage: Modified - name: Modified2965 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770036,"checksum":"a2da8f97629cf2315f5f8a80f069beaa7984adc5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770036,"checksum":"a2da8f97629cf2315f5f8a80f069beaa7984adc5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key", "arch": "[x64]", "timestamp": 1606816934, "attributes": {"type": "registry_key", "mtime": 1606770036, "checksum": "a2da8f97629cf2315f5f8a80f069beaa7984adc5"}}' stage: Modified - name: Modified2966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170187,14 +170187,14 @@ stage: Modified - name: Modified2967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770037,"checksum":"c3f748155514084bad48462694775915fb6a8305"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770037,"checksum":"c3f748155514084bad48462694775915fb6a8305"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key", "arch": "[x64]", "timestamp": 1606816934, "attributes": {"type": "registry_key", "mtime": 1606770037, "checksum": "c3f748155514084bad48462694775915fb6a8305"}}' stage: Modified - name: Modified2968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170203,14 +170203,14 @@ stage: Modified - name: Modified2969 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770037,"checksum":"c3f748155514084bad48462694775915fb6a8305"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770037,"checksum":"c3f748155514084bad48462694775915fb6a8305"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key", "arch": "[x64]", "timestamp": 1606816934, "attributes": {"type": "registry_key", "mtime": 1606770037, "checksum": "c3f748155514084bad48462694775915fb6a8305"}}' stage: Modified - name: Modified2970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170220,14 +170220,14 @@ stage: Modified - name: Modified2971 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770037,"checksum":"c3f748155514084bad48462694775915fb6a8305"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770037,"checksum":"c3f748155514084bad48462694775915fb6a8305"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key", "arch": "[x64]", "timestamp": 1606816934, "attributes": {"type": "registry_key", "mtime": 1606770037, "checksum": "c3f748155514084bad48462694775915fb6a8305"}}' stage: Modified - name: Modified2972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170237,14 +170237,14 @@ stage: Modified - name: Modified2973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770037,"checksum":"c3f748155514084bad48462694775915fb6a8305"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770037,"checksum":"c3f748155514084bad48462694775915fb6a8305"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key", "arch": "[x64]", "timestamp": 1606816934, "attributes": {"type": "registry_key", "mtime": 1606770037, "checksum": "c3f748155514084bad48462694775915fb6a8305"}}' stage: Modified - name: Modified2974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170253,14 +170253,14 @@ stage: Modified - name: Modified2975 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770037,"checksum":"c3f748155514084bad48462694775915fb6a8305"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","mtime":1606770037,"checksum":"c3f748155514084bad48462694775915fb6a8305"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key", "arch": "[x64]", "timestamp": 1606816934, "attributes": {"type": "registry_key", "mtime": 1606770037, "checksum": "c3f748155514084bad48462694775915fb6a8305"}}' stage: Modified - name: Modified2976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170269,7 +170269,7 @@ stage: Modified - name: Modified2977 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2680\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2680\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170279,7 +170279,7 @@ stage: Modified - name: Modified2978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2681\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2681\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170289,7 +170289,7 @@ stage: Modified - name: Modified2979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2682\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2682\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170298,7 +170298,7 @@ stage: Modified - name: Modified2980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2683\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2683\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170307,7 +170307,7 @@ stage: Modified - name: Modified2981 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2684\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2684\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170317,7 +170317,7 @@ stage: Modified - name: Modified2982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2685\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2685\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170327,7 +170327,7 @@ stage: Modified - name: Modified2983 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2686\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2686\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170336,7 +170336,7 @@ stage: Modified - name: Modified2984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2687\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["size","sha1","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2687\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170345,7 +170345,7 @@ stage: Modified - name: Modified2985 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170368,7 +170368,7 @@ stage: Modified - name: Modified2986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170378,7 +170378,7 @@ stage: Modified - name: Modified2987 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816934,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170401,7 +170401,7 @@ stage: Modified - name: Modified2988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816934,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816934, "attributes": @@ -170411,7 +170411,7 @@ stage: Modified - name: Modified2989 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170434,7 +170434,7 @@ stage: Modified - name: Modified2990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170443,7 +170443,7 @@ stage: Modified - name: Modified2991 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170466,7 +170466,7 @@ stage: Modified - name: Modified2992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170475,7 +170475,7 @@ stage: Modified - name: Modified2993 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170498,7 +170498,7 @@ stage: Modified - name: Modified2994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -170508,7 +170508,7 @@ stage: Modified - name: Modified2995 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170531,7 +170531,7 @@ stage: Modified - name: Modified2996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -170541,7 +170541,7 @@ stage: Modified - name: Modified2997 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170564,7 +170564,7 @@ stage: Modified - name: Modified2998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170573,7 +170573,7 @@ stage: Modified - name: Modified2999 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170596,7 +170596,7 @@ stage: Modified - name: Modified3000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170605,7 +170605,7 @@ stage: Modified - name: Modified3001 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2696\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170628,7 +170628,7 @@ stage: Modified - name: Modified3002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2696\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2696\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -170638,7 +170638,7 @@ stage: Modified - name: Modified3003 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2697\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170661,7 +170661,7 @@ stage: Modified - name: Modified3004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2697\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2697\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -170671,7 +170671,7 @@ stage: Modified - name: Modified3005 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2698\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170694,7 +170694,7 @@ stage: Modified - name: Modified3006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2698\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2698\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170703,7 +170703,7 @@ stage: Modified - name: Modified3007 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2699\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170726,7 +170726,7 @@ stage: Modified - name: Modified3008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2699\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2699\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170735,7 +170735,7 @@ stage: Modified - name: Modified3009 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2700\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170758,7 +170758,7 @@ stage: Modified - name: Modified3010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2700\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2700\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -170768,7 +170768,7 @@ stage: Modified - name: Modified3011 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2701\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170791,7 +170791,7 @@ stage: Modified - name: Modified3012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2701\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2701\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -170801,7 +170801,7 @@ stage: Modified - name: Modified3013 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2702\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170824,7 +170824,7 @@ stage: Modified - name: Modified3014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2702\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2702\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170833,7 +170833,7 @@ stage: Modified - name: Modified3015 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2703\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -170856,7 +170856,7 @@ stage: Modified - name: Modified3016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2703\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2703\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170865,7 +170865,7 @@ stage: Modified - name: Modified3017 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -170874,7 +170874,7 @@ stage: Modified - name: Modified3018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -170884,7 +170884,7 @@ stage: Modified - name: Modified3019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -170893,7 +170893,7 @@ stage: Modified - name: Modified3020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -170903,7 +170903,7 @@ stage: Modified - name: Modified3021 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -170912,7 +170912,7 @@ stage: Modified - name: Modified3022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170921,7 +170921,7 @@ stage: Modified - name: Modified3023 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -170930,7 +170930,7 @@ stage: Modified - name: Modified3024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170939,7 +170939,7 @@ stage: Modified - name: Modified3025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -170948,7 +170948,7 @@ stage: Modified - name: Modified3026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -170958,7 +170958,7 @@ stage: Modified - name: Modified3027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -170967,7 +170967,7 @@ stage: Modified - name: Modified3028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -170977,7 +170977,7 @@ stage: Modified - name: Modified3029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -170986,7 +170986,7 @@ stage: Modified - name: Modified3030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -170995,7 +170995,7 @@ stage: Modified - name: Modified3031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770037,"checksum":"ba5147f0bed293590c94ea291a8e42104b2d59a0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171004,7 +171004,7 @@ stage: Modified - name: Modified3032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171013,7 +171013,7 @@ stage: Modified - name: Modified3033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171022,7 +171022,7 @@ stage: Modified - name: Modified3034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2712\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -171032,7 +171032,7 @@ stage: Modified - name: Modified3035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171041,7 +171041,7 @@ stage: Modified - name: Modified3036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2713\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -171051,7 +171051,7 @@ stage: Modified - name: Modified3037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171060,7 +171060,7 @@ stage: Modified - name: Modified3038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2714\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171069,7 +171069,7 @@ stage: Modified - name: Modified3039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171078,7 +171078,7 @@ stage: Modified - name: Modified3040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2715\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171087,7 +171087,7 @@ stage: Modified - name: Modified3041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171096,7 +171096,7 @@ stage: Modified - name: Modified3042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2716\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -171106,7 +171106,7 @@ stage: Modified - name: Modified3043 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171115,7 +171115,7 @@ stage: Modified - name: Modified3044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2717\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -171125,7 +171125,7 @@ stage: Modified - name: Modified3045 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171134,7 +171134,7 @@ stage: Modified - name: Modified3046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2718\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171143,7 +171143,7 @@ stage: Modified - name: Modified3047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key", "arch": "[x64]", "timestamp": 1606816935, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171152,7 +171152,7 @@ stage: Modified - name: Modified3048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2719\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171161,7 +171161,7 @@ stage: Modified - name: Modified3049 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171183,7 +171183,7 @@ stage: Modified - name: Modified3050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -171193,7 +171193,7 @@ stage: Modified - name: Modified3051 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171215,7 +171215,7 @@ stage: Modified - name: Modified3052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": @@ -171225,7 +171225,7 @@ stage: Modified - name: Modified3053 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816935,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171247,7 +171247,7 @@ stage: Modified - name: Modified3054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816935,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816935, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171256,7 +171256,7 @@ stage: Modified - name: Modified3055 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171278,7 +171278,7 @@ stage: Modified - name: Modified3056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171287,7 +171287,7 @@ stage: Modified - name: Modified3057 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171309,7 +171309,7 @@ stage: Modified - name: Modified3058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171319,7 +171319,7 @@ stage: Modified - name: Modified3059 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171341,7 +171341,7 @@ stage: Modified - name: Modified3060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171351,7 +171351,7 @@ stage: Modified - name: Modified3061 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171373,7 +171373,7 @@ stage: Modified - name: Modified3062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171382,7 +171382,7 @@ stage: Modified - name: Modified3063 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171404,7 +171404,7 @@ stage: Modified - name: Modified3064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171413,7 +171413,7 @@ stage: Modified - name: Modified3065 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2728\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171435,7 +171435,7 @@ stage: Modified - name: Modified3066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2728\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2728\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171445,7 +171445,7 @@ stage: Modified - name: Modified3067 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2729\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171467,7 +171467,7 @@ stage: Modified - name: Modified3068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2729\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2729\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171477,7 +171477,7 @@ stage: Modified - name: Modified3069 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2730\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171499,7 +171499,7 @@ stage: Modified - name: Modified3070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2730\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2730\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171508,7 +171508,7 @@ stage: Modified - name: Modified3071 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2731\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171530,7 +171530,7 @@ stage: Modified - name: Modified3072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2731\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2731\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171539,7 +171539,7 @@ stage: Modified - name: Modified3073 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2732\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171561,7 +171561,7 @@ stage: Modified - name: Modified3074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2732\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2732\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171571,7 +171571,7 @@ stage: Modified - name: Modified3075 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2733\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171593,7 +171593,7 @@ stage: Modified - name: Modified3076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2733\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2733\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171603,7 +171603,7 @@ stage: Modified - name: Modified3077 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2734\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171625,7 +171625,7 @@ stage: Modified - name: Modified3078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2734\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2734\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171634,7 +171634,7 @@ stage: Modified - name: Modified3079 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2735\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171656,7 +171656,7 @@ stage: Modified - name: Modified3080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2735\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2735\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171665,7 +171665,7 @@ stage: Modified - name: Modified3081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171673,7 +171673,7 @@ stage: Modified - name: Modified3082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171683,7 +171683,7 @@ stage: Modified - name: Modified3083 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171691,7 +171691,7 @@ stage: Modified - name: Modified3084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171701,7 +171701,7 @@ stage: Modified - name: Modified3085 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171709,7 +171709,7 @@ stage: Modified - name: Modified3086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171718,7 +171718,7 @@ stage: Modified - name: Modified3087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171726,7 +171726,7 @@ stage: Modified - name: Modified3088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171735,7 +171735,7 @@ stage: Modified - name: Modified3089 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171743,7 +171743,7 @@ stage: Modified - name: Modified3090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171753,7 +171753,7 @@ stage: Modified - name: Modified3091 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171761,7 +171761,7 @@ stage: Modified - name: Modified3092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171771,7 +171771,7 @@ stage: Modified - name: Modified3093 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171779,7 +171779,7 @@ stage: Modified - name: Modified3094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171788,7 +171788,7 @@ stage: Modified - name: Modified3095 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770038,"checksum":"d3968ba0fe86ca101f2704a7816eb10f485545c5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171796,7 +171796,7 @@ stage: Modified - name: Modified3096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171805,7 +171805,7 @@ stage: Modified - name: Modified3097 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171813,7 +171813,7 @@ stage: Modified - name: Modified3098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2744\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171823,7 +171823,7 @@ stage: Modified - name: Modified3099 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171831,7 +171831,7 @@ stage: Modified - name: Modified3100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2745\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171841,7 +171841,7 @@ stage: Modified - name: Modified3101 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171849,7 +171849,7 @@ stage: Modified - name: Modified3102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2746\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171858,7 +171858,7 @@ stage: Modified - name: Modified3103 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171866,7 +171866,7 @@ stage: Modified - name: Modified3104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2747\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171875,7 +171875,7 @@ stage: Modified - name: Modified3105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171883,7 +171883,7 @@ stage: Modified - name: Modified3106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2748\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171893,7 +171893,7 @@ stage: Modified - name: Modified3107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171901,7 +171901,7 @@ stage: Modified - name: Modified3108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2749\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171911,7 +171911,7 @@ stage: Modified - name: Modified3109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171919,7 +171919,7 @@ stage: Modified - name: Modified3110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2750\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171928,7 +171928,7 @@ stage: Modified - name: Modified3111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key", "arch": "[x64]", "timestamp": 1606816936, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -171936,7 +171936,7 @@ stage: Modified - name: Modified3112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2751\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -171945,7 +171945,7 @@ stage: Modified - name: Modified3113 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171967,7 +171967,7 @@ stage: Modified - name: Modified3114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -171977,7 +171977,7 @@ stage: Modified - name: Modified3115 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -171999,7 +171999,7 @@ stage: Modified - name: Modified3116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -172009,7 +172009,7 @@ stage: Modified - name: Modified3117 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172031,7 +172031,7 @@ stage: Modified - name: Modified3118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172040,7 +172040,7 @@ stage: Modified - name: Modified3119 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172062,7 +172062,7 @@ stage: Modified - name: Modified3120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172071,7 +172071,7 @@ stage: Modified - name: Modified3121 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816936,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172093,7 +172093,7 @@ stage: Modified - name: Modified3122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816936,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816936, "attributes": @@ -172103,7 +172103,7 @@ stage: Modified - name: Modified3123 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172125,7 +172125,7 @@ stage: Modified - name: Modified3124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172135,7 +172135,7 @@ stage: Modified - name: Modified3125 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172157,7 +172157,7 @@ stage: Modified - name: Modified3126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172166,7 +172166,7 @@ stage: Modified - name: Modified3127 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172188,7 +172188,7 @@ stage: Modified - name: Modified3128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172197,7 +172197,7 @@ stage: Modified - name: Modified3129 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2760\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172219,7 +172219,7 @@ stage: Modified - name: Modified3130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2760\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2760\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172229,7 +172229,7 @@ stage: Modified - name: Modified3131 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2761\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172251,7 +172251,7 @@ stage: Modified - name: Modified3132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2761\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2761\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172261,7 +172261,7 @@ stage: Modified - name: Modified3133 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2762\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172283,7 +172283,7 @@ stage: Modified - name: Modified3134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2762\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2762\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172292,7 +172292,7 @@ stage: Modified - name: Modified3135 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2763\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172314,7 +172314,7 @@ stage: Modified - name: Modified3136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2763\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2763\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172323,7 +172323,7 @@ stage: Modified - name: Modified3137 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2764\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172345,7 +172345,7 @@ stage: Modified - name: Modified3138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2764\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2764\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172355,7 +172355,7 @@ stage: Modified - name: Modified3139 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2765\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172377,7 +172377,7 @@ stage: Modified - name: Modified3140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2765\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2765\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172387,7 +172387,7 @@ stage: Modified - name: Modified3141 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2766\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172409,7 +172409,7 @@ stage: Modified - name: Modified3142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2766\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2766\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172418,7 +172418,7 @@ stage: Modified - name: Modified3143 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2767\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172440,7 +172440,7 @@ stage: Modified - name: Modified3144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2767\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2767\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172449,7 +172449,7 @@ stage: Modified - name: Modified3145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key", "arch": "[x64]", "timestamp": 1606816937, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -172457,7 +172457,7 @@ stage: Modified - name: Modified3146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172467,7 +172467,7 @@ stage: Modified - name: Modified3147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key", "arch": "[x64]", "timestamp": 1606816937, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -172475,7 +172475,7 @@ stage: Modified - name: Modified3148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172485,7 +172485,7 @@ stage: Modified - name: Modified3149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key", "arch": "[x64]", "timestamp": 1606816937, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -172493,7 +172493,7 @@ stage: Modified - name: Modified3150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172502,7 +172502,7 @@ stage: Modified - name: Modified3151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key", "arch": "[x64]", "timestamp": 1606816937, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -172510,7 +172510,7 @@ stage: Modified - name: Modified3152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172519,7 +172519,7 @@ stage: Modified - name: Modified3153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key", "arch": "[x64]", "timestamp": 1606816937, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -172527,7 +172527,7 @@ stage: Modified - name: Modified3154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172537,7 +172537,7 @@ stage: Modified - name: Modified3155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key", "arch": "[x64]", "timestamp": 1606816937, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -172545,7 +172545,7 @@ stage: Modified - name: Modified3156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172555,7 +172555,7 @@ stage: Modified - name: Modified3157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key", "arch": "[x64]", "timestamp": 1606816937, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -172563,7 +172563,7 @@ stage: Modified - name: Modified3158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172572,7 +172572,7 @@ stage: Modified - name: Modified3159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770038,"checksum":"2df7119062bd0fa7d51cca98d6d6796e0a1007ea"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key", "arch": "[x64]", "timestamp": 1606816937, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -172580,7 +172580,7 @@ stage: Modified - name: Modified3160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172589,7 +172589,7 @@ stage: Modified - name: Modified3161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2776\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2776\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172599,7 +172599,7 @@ stage: Modified - name: Modified3162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2777\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2777\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172609,7 +172609,7 @@ stage: Modified - name: Modified3163 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2778\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2778\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172618,7 +172618,7 @@ stage: Modified - name: Modified3164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2779\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2779\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172627,7 +172627,7 @@ stage: Modified - name: Modified3165 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2780\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2780\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172637,7 +172637,7 @@ stage: Modified - name: Modified3166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2781\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2781\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172647,7 +172647,7 @@ stage: Modified - name: Modified3167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2782\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2782\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172656,7 +172656,7 @@ stage: Modified - name: Modified3168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2783\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2783\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172665,7 +172665,7 @@ stage: Modified - name: Modified3169 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172686,7 +172686,7 @@ stage: Modified - name: Modified3170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172696,7 +172696,7 @@ stage: Modified - name: Modified3171 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172717,7 +172717,7 @@ stage: Modified - name: Modified3172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172727,7 +172727,7 @@ stage: Modified - name: Modified3173 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172748,7 +172748,7 @@ stage: Modified - name: Modified3174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172757,7 +172757,7 @@ stage: Modified - name: Modified3175 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172778,7 +172778,7 @@ stage: Modified - name: Modified3176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172787,7 +172787,7 @@ stage: Modified - name: Modified3177 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816937,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172808,7 +172808,7 @@ stage: Modified - name: Modified3178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816937,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816937, "attributes": @@ -172818,7 +172818,7 @@ stage: Modified - name: Modified3179 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172839,7 +172839,7 @@ stage: Modified - name: Modified3180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -172849,7 +172849,7 @@ stage: Modified - name: Modified3181 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172870,7 +172870,7 @@ stage: Modified - name: Modified3182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172879,7 +172879,7 @@ stage: Modified - name: Modified3183 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172900,7 +172900,7 @@ stage: Modified - name: Modified3184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -172909,7 +172909,7 @@ stage: Modified - name: Modified3185 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2792\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172930,7 +172930,7 @@ stage: Modified - name: Modified3186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2792\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2792\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -172940,7 +172940,7 @@ stage: Modified - name: Modified3187 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2793\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172961,7 +172961,7 @@ stage: Modified - name: Modified3188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2793\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2793\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -172971,7 +172971,7 @@ stage: Modified - name: Modified3189 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2794\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -172992,7 +172992,7 @@ stage: Modified - name: Modified3190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2794\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2794\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173001,7 +173001,7 @@ stage: Modified - name: Modified3191 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2795\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173022,7 +173022,7 @@ stage: Modified - name: Modified3192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2795\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2795\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173031,7 +173031,7 @@ stage: Modified - name: Modified3193 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2796\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173052,7 +173052,7 @@ stage: Modified - name: Modified3194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2796\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2796\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173062,7 +173062,7 @@ stage: Modified - name: Modified3195 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2797\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173083,7 +173083,7 @@ stage: Modified - name: Modified3196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2797\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2797\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173093,7 +173093,7 @@ stage: Modified - name: Modified3197 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2798\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173114,7 +173114,7 @@ stage: Modified - name: Modified3198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2798\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2798\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173123,7 +173123,7 @@ stage: Modified - name: Modified3199 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2799\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173144,7 +173144,7 @@ stage: Modified - name: Modified3200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2799\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2799\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173153,14 +173153,14 @@ stage: Modified - name: Modified3201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key", "arch": "[x64]", "timestamp": 1606816938, "attributes": {"type": "registry_key", "mtime": 1606770039, "checksum": "b540db269e6b42dc824f7bb820b6834284a38765"}}' stage: Modified - name: Modified3202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173170,14 +173170,14 @@ stage: Modified - name: Modified3203 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key", "arch": "[x64]", "timestamp": 1606816938, "attributes": {"type": "registry_key", "mtime": 1606770039, "checksum": "b540db269e6b42dc824f7bb820b6834284a38765"}}' stage: Modified - name: Modified3204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173187,14 +173187,14 @@ stage: Modified - name: Modified3205 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key", "arch": "[x64]", "timestamp": 1606816938, "attributes": {"type": "registry_key", "mtime": 1606770039, "checksum": "b540db269e6b42dc824f7bb820b6834284a38765"}}' stage: Modified - name: Modified3206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173203,14 +173203,14 @@ stage: Modified - name: Modified3207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key", "arch": "[x64]", "timestamp": 1606816938, "attributes": {"type": "registry_key", "mtime": 1606770039, "checksum": "b540db269e6b42dc824f7bb820b6834284a38765"}}' stage: Modified - name: Modified3208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173219,14 +173219,14 @@ stage: Modified - name: Modified3209 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key", "arch": "[x64]", "timestamp": 1606816938, "attributes": {"type": "registry_key", "mtime": 1606770039, "checksum": "b540db269e6b42dc824f7bb820b6834284a38765"}}' stage: Modified - name: Modified3210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173236,14 +173236,14 @@ stage: Modified - name: Modified3211 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key", "arch": "[x64]", "timestamp": 1606816938, "attributes": {"type": "registry_key", "mtime": 1606770039, "checksum": "b540db269e6b42dc824f7bb820b6834284a38765"}}' stage: Modified - name: Modified3212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173253,14 +173253,14 @@ stage: Modified - name: Modified3213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key", "arch": "[x64]", "timestamp": 1606816938, "attributes": {"type": "registry_key", "mtime": 1606770039, "checksum": "b540db269e6b42dc824f7bb820b6834284a38765"}}' stage: Modified - name: Modified3214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173269,14 +173269,14 @@ stage: Modified - name: Modified3215 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","mtime":1606770039,"checksum":"b540db269e6b42dc824f7bb820b6834284a38765"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key", "arch": "[x64]", "timestamp": 1606816938, "attributes": {"type": "registry_key", "mtime": 1606770039, "checksum": "b540db269e6b42dc824f7bb820b6834284a38765"}}' stage: Modified - name: Modified3216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173285,7 +173285,7 @@ stage: Modified - name: Modified3217 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2808\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2808\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173295,7 +173295,7 @@ stage: Modified - name: Modified3218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2809\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2809\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173305,7 +173305,7 @@ stage: Modified - name: Modified3219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2810\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2810\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173314,7 +173314,7 @@ stage: Modified - name: Modified3220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2811\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2811\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173323,7 +173323,7 @@ stage: Modified - name: Modified3221 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2812\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2812\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173333,7 +173333,7 @@ stage: Modified - name: Modified3222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2813\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2813\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173343,7 +173343,7 @@ stage: Modified - name: Modified3223 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2814\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2814\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173352,7 +173352,7 @@ stage: Modified - name: Modified3224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2815\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"e2ce472ff829bff08b78c8ed29c5d4ecc40d35d7"},"changed_attributes":["sha1","sha256"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"ecd99e127705aab4b447390ade22c38ffc0bb611"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2815\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173361,7 +173361,7 @@ stage: Modified - name: Modified3225 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173384,7 +173384,7 @@ stage: Modified - name: Modified3226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173393,7 +173393,7 @@ stage: Modified - name: Modified3227 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173416,7 +173416,7 @@ stage: Modified - name: Modified3228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173425,7 +173425,7 @@ stage: Modified - name: Modified3229 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173448,7 +173448,7 @@ stage: Modified - name: Modified3230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173456,7 +173456,7 @@ stage: Modified - name: Modified3231 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173479,7 +173479,7 @@ stage: Modified - name: Modified3232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173487,7 +173487,7 @@ stage: Modified - name: Modified3233 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173510,7 +173510,7 @@ stage: Modified - name: Modified3234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173519,7 +173519,7 @@ stage: Modified - name: Modified3235 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173542,7 +173542,7 @@ stage: Modified - name: Modified3236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173551,7 +173551,7 @@ stage: Modified - name: Modified3237 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173574,7 +173574,7 @@ stage: Modified - name: Modified3238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173582,7 +173582,7 @@ stage: Modified - name: Modified3239 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173605,7 +173605,7 @@ stage: Modified - name: Modified3240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173613,7 +173613,7 @@ stage: Modified - name: Modified3241 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2824\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816938,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173636,7 +173636,7 @@ stage: Modified - name: Modified3242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2824\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816938,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2824\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816938, "attributes": @@ -173645,7 +173645,7 @@ stage: Modified - name: Modified3243 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2825\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173668,7 +173668,7 @@ stage: Modified - name: Modified3244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2825\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2825\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -173677,7 +173677,7 @@ stage: Modified - name: Modified3245 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2826\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173700,7 +173700,7 @@ stage: Modified - name: Modified3246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2826\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2826\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173708,7 +173708,7 @@ stage: Modified - name: Modified3247 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2827\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173731,7 +173731,7 @@ stage: Modified - name: Modified3248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2827\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2827\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173739,7 +173739,7 @@ stage: Modified - name: Modified3249 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2828\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173762,7 +173762,7 @@ stage: Modified - name: Modified3250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2828\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2828\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -173771,7 +173771,7 @@ stage: Modified - name: Modified3251 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2829\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173794,7 +173794,7 @@ stage: Modified - name: Modified3252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2829\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2829\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -173803,7 +173803,7 @@ stage: Modified - name: Modified3253 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2830\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173826,7 +173826,7 @@ stage: Modified - name: Modified3254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2830\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2830\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173834,7 +173834,7 @@ stage: Modified - name: Modified3255 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2831\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -173857,7 +173857,7 @@ stage: Modified - name: Modified3256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2831\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2831\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173865,7 +173865,7 @@ stage: Modified - name: Modified3257 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -173874,7 +173874,7 @@ stage: Modified - name: Modified3258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -173883,7 +173883,7 @@ stage: Modified - name: Modified3259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -173892,7 +173892,7 @@ stage: Modified - name: Modified3260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -173901,7 +173901,7 @@ stage: Modified - name: Modified3261 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -173910,7 +173910,7 @@ stage: Modified - name: Modified3262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173918,7 +173918,7 @@ stage: Modified - name: Modified3263 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -173927,7 +173927,7 @@ stage: Modified - name: Modified3264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173935,7 +173935,7 @@ stage: Modified - name: Modified3265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -173944,7 +173944,7 @@ stage: Modified - name: Modified3266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -173953,7 +173953,7 @@ stage: Modified - name: Modified3267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -173962,7 +173962,7 @@ stage: Modified - name: Modified3268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -173971,7 +173971,7 @@ stage: Modified - name: Modified3269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -173980,7 +173980,7 @@ stage: Modified - name: Modified3270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -173988,7 +173988,7 @@ stage: Modified - name: Modified3271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770039,"checksum":"1c0fac33acd775295e64984c283068d7995635bf"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -173997,7 +173997,7 @@ stage: Modified - name: Modified3272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174005,7 +174005,7 @@ stage: Modified - name: Modified3273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174014,7 +174014,7 @@ stage: Modified - name: Modified3274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2840\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174023,7 +174023,7 @@ stage: Modified - name: Modified3275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174032,7 +174032,7 @@ stage: Modified - name: Modified3276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2841\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174041,7 +174041,7 @@ stage: Modified - name: Modified3277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174050,7 +174050,7 @@ stage: Modified - name: Modified3278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2842\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174058,7 +174058,7 @@ stage: Modified - name: Modified3279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174067,7 +174067,7 @@ stage: Modified - name: Modified3280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2843\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174075,7 +174075,7 @@ stage: Modified - name: Modified3281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174084,7 +174084,7 @@ stage: Modified - name: Modified3282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2844\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174093,7 +174093,7 @@ stage: Modified - name: Modified3283 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174102,7 +174102,7 @@ stage: Modified - name: Modified3284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2845\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174111,7 +174111,7 @@ stage: Modified - name: Modified3285 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174120,7 +174120,7 @@ stage: Modified - name: Modified3286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2846\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174128,7 +174128,7 @@ stage: Modified - name: Modified3287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key", "arch": "[x64]", "timestamp": 1606816939, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174137,7 +174137,7 @@ stage: Modified - name: Modified3288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2847\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174145,7 +174145,7 @@ stage: Modified - name: Modified3289 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174167,7 +174167,7 @@ stage: Modified - name: Modified3290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174176,7 +174176,7 @@ stage: Modified - name: Modified3291 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174198,7 +174198,7 @@ stage: Modified - name: Modified3292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174207,7 +174207,7 @@ stage: Modified - name: Modified3293 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174229,7 +174229,7 @@ stage: Modified - name: Modified3294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174237,7 +174237,7 @@ stage: Modified - name: Modified3295 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174259,7 +174259,7 @@ stage: Modified - name: Modified3296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174267,7 +174267,7 @@ stage: Modified - name: Modified3297 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174289,7 +174289,7 @@ stage: Modified - name: Modified3298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174298,7 +174298,7 @@ stage: Modified - name: Modified3299 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174320,7 +174320,7 @@ stage: Modified - name: Modified3300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174329,7 +174329,7 @@ stage: Modified - name: Modified3301 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174351,7 +174351,7 @@ stage: Modified - name: Modified3302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174359,7 +174359,7 @@ stage: Modified - name: Modified3303 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174381,7 +174381,7 @@ stage: Modified - name: Modified3304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174389,7 +174389,7 @@ stage: Modified - name: Modified3305 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2856\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174411,7 +174411,7 @@ stage: Modified - name: Modified3306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2856\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2856\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174420,7 +174420,7 @@ stage: Modified - name: Modified3307 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2857\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174442,7 +174442,7 @@ stage: Modified - name: Modified3308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2857\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2857\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174451,7 +174451,7 @@ stage: Modified - name: Modified3309 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2858\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174473,7 +174473,7 @@ stage: Modified - name: Modified3310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2858\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2858\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174481,7 +174481,7 @@ stage: Modified - name: Modified3311 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2859\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174503,7 +174503,7 @@ stage: Modified - name: Modified3312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2859\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2859\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174511,7 +174511,7 @@ stage: Modified - name: Modified3313 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2860\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174533,7 +174533,7 @@ stage: Modified - name: Modified3314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2860\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2860\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174542,7 +174542,7 @@ stage: Modified - name: Modified3315 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2861\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816939,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174564,7 +174564,7 @@ stage: Modified - name: Modified3316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2861\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816939,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2861\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816939, "attributes": @@ -174573,7 +174573,7 @@ stage: Modified - name: Modified3317 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2862\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174595,7 +174595,7 @@ stage: Modified - name: Modified3318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2862\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2862\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174603,7 +174603,7 @@ stage: Modified - name: Modified3319 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2863\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174625,7 +174625,7 @@ stage: Modified - name: Modified3320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2863\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2863\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174633,7 +174633,7 @@ stage: Modified - name: Modified3321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174641,7 +174641,7 @@ stage: Modified - name: Modified3322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -174650,7 +174650,7 @@ stage: Modified - name: Modified3323 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174658,7 +174658,7 @@ stage: Modified - name: Modified3324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -174667,7 +174667,7 @@ stage: Modified - name: Modified3325 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174675,7 +174675,7 @@ stage: Modified - name: Modified3326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174683,7 +174683,7 @@ stage: Modified - name: Modified3327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174691,7 +174691,7 @@ stage: Modified - name: Modified3328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174699,7 +174699,7 @@ stage: Modified - name: Modified3329 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174707,7 +174707,7 @@ stage: Modified - name: Modified3330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -174716,7 +174716,7 @@ stage: Modified - name: Modified3331 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174724,7 +174724,7 @@ stage: Modified - name: Modified3332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -174733,7 +174733,7 @@ stage: Modified - name: Modified3333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174741,7 +174741,7 @@ stage: Modified - name: Modified3334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174749,7 +174749,7 @@ stage: Modified - name: Modified3335 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770040,"checksum":"097a331586bdab2a81ff50c6644c1171200ad902"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174757,7 +174757,7 @@ stage: Modified - name: Modified3336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174765,7 +174765,7 @@ stage: Modified - name: Modified3337 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174773,7 +174773,7 @@ stage: Modified - name: Modified3338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2872\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -174782,7 +174782,7 @@ stage: Modified - name: Modified3339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174790,7 +174790,7 @@ stage: Modified - name: Modified3340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2873\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -174799,7 +174799,7 @@ stage: Modified - name: Modified3341 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174807,7 +174807,7 @@ stage: Modified - name: Modified3342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2874\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174815,7 +174815,7 @@ stage: Modified - name: Modified3343 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174823,7 +174823,7 @@ stage: Modified - name: Modified3344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2875\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174831,7 +174831,7 @@ stage: Modified - name: Modified3345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174839,7 +174839,7 @@ stage: Modified - name: Modified3346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2876\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -174848,7 +174848,7 @@ stage: Modified - name: Modified3347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174856,7 +174856,7 @@ stage: Modified - name: Modified3348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2877\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -174865,7 +174865,7 @@ stage: Modified - name: Modified3349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174873,7 +174873,7 @@ stage: Modified - name: Modified3350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2878\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174881,7 +174881,7 @@ stage: Modified - name: Modified3351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -174889,7 +174889,7 @@ stage: Modified - name: Modified3352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2879\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174897,7 +174897,7 @@ stage: Modified - name: Modified3353 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174919,7 +174919,7 @@ stage: Modified - name: Modified3354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -174928,7 +174928,7 @@ stage: Modified - name: Modified3355 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174950,7 +174950,7 @@ stage: Modified - name: Modified3356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -174959,7 +174959,7 @@ stage: Modified - name: Modified3357 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -174981,7 +174981,7 @@ stage: Modified - name: Modified3358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -174989,7 +174989,7 @@ stage: Modified - name: Modified3359 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175011,7 +175011,7 @@ stage: Modified - name: Modified3360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175019,7 +175019,7 @@ stage: Modified - name: Modified3361 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175041,7 +175041,7 @@ stage: Modified - name: Modified3362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -175050,7 +175050,7 @@ stage: Modified - name: Modified3363 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175072,7 +175072,7 @@ stage: Modified - name: Modified3364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -175081,7 +175081,7 @@ stage: Modified - name: Modified3365 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175103,7 +175103,7 @@ stage: Modified - name: Modified3366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175111,7 +175111,7 @@ stage: Modified - name: Modified3367 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175133,7 +175133,7 @@ stage: Modified - name: Modified3368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175141,7 +175141,7 @@ stage: Modified - name: Modified3369 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2888\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175163,7 +175163,7 @@ stage: Modified - name: Modified3370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2888\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2888\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -175172,7 +175172,7 @@ stage: Modified - name: Modified3371 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2889\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175194,7 +175194,7 @@ stage: Modified - name: Modified3372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2889\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2889\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -175203,7 +175203,7 @@ stage: Modified - name: Modified3373 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2890\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175225,7 +175225,7 @@ stage: Modified - name: Modified3374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2890\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2890\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175233,7 +175233,7 @@ stage: Modified - name: Modified3375 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2891\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175255,7 +175255,7 @@ stage: Modified - name: Modified3376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2891\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2891\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175263,7 +175263,7 @@ stage: Modified - name: Modified3377 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2892\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175285,7 +175285,7 @@ stage: Modified - name: Modified3378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2892\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2892\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -175294,7 +175294,7 @@ stage: Modified - name: Modified3379 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2893\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175316,7 +175316,7 @@ stage: Modified - name: Modified3380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2893\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2893\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -175325,7 +175325,7 @@ stage: Modified - name: Modified3381 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2894\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175347,7 +175347,7 @@ stage: Modified - name: Modified3382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2894\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2894\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175355,7 +175355,7 @@ stage: Modified - name: Modified3383 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2895\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175377,7 +175377,7 @@ stage: Modified - name: Modified3384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2895\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2895\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175385,7 +175385,7 @@ stage: Modified - name: Modified3385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -175393,7 +175393,7 @@ stage: Modified - name: Modified3386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -175402,7 +175402,7 @@ stage: Modified - name: Modified3387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816940,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key", "arch": "[x64]", "timestamp": 1606816940, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -175410,7 +175410,7 @@ stage: Modified - name: Modified3388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816940,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816940, "attributes": @@ -175419,7 +175419,7 @@ stage: Modified - name: Modified3389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -175427,7 +175427,7 @@ stage: Modified - name: Modified3390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175435,7 +175435,7 @@ stage: Modified - name: Modified3391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -175443,7 +175443,7 @@ stage: Modified - name: Modified3392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175451,7 +175451,7 @@ stage: Modified - name: Modified3393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -175459,7 +175459,7 @@ stage: Modified - name: Modified3394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175468,7 +175468,7 @@ stage: Modified - name: Modified3395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -175476,7 +175476,7 @@ stage: Modified - name: Modified3396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175485,7 +175485,7 @@ stage: Modified - name: Modified3397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -175493,7 +175493,7 @@ stage: Modified - name: Modified3398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175501,7 +175501,7 @@ stage: Modified - name: Modified3399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770040,"checksum":"faf2973f580ad066c4d5b9a5f6d22f2fb93c4439"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -175509,7 +175509,7 @@ stage: Modified - name: Modified3400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175517,7 +175517,7 @@ stage: Modified - name: Modified3401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2904\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2904\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175526,7 +175526,7 @@ stage: Modified - name: Modified3402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2905\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2905\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175535,7 +175535,7 @@ stage: Modified - name: Modified3403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2906\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2906\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175543,7 +175543,7 @@ stage: Modified - name: Modified3404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2907\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2907\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175551,7 +175551,7 @@ stage: Modified - name: Modified3405 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2908\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2908\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175560,7 +175560,7 @@ stage: Modified - name: Modified3406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2909\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2909\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175569,7 +175569,7 @@ stage: Modified - name: Modified3407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2910\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2910\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175577,7 +175577,7 @@ stage: Modified - name: Modified3408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2911\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2911\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175585,7 +175585,7 @@ stage: Modified - name: Modified3409 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175606,7 +175606,7 @@ stage: Modified - name: Modified3410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175615,7 +175615,7 @@ stage: Modified - name: Modified3411 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175636,7 +175636,7 @@ stage: Modified - name: Modified3412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175645,7 +175645,7 @@ stage: Modified - name: Modified3413 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175666,7 +175666,7 @@ stage: Modified - name: Modified3414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175674,7 +175674,7 @@ stage: Modified - name: Modified3415 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175695,7 +175695,7 @@ stage: Modified - name: Modified3416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175703,7 +175703,7 @@ stage: Modified - name: Modified3417 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175724,7 +175724,7 @@ stage: Modified - name: Modified3418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175733,7 +175733,7 @@ stage: Modified - name: Modified3419 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175754,7 +175754,7 @@ stage: Modified - name: Modified3420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175763,7 +175763,7 @@ stage: Modified - name: Modified3421 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175784,7 +175784,7 @@ stage: Modified - name: Modified3422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175792,7 +175792,7 @@ stage: Modified - name: Modified3423 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175813,7 +175813,7 @@ stage: Modified - name: Modified3424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175821,7 +175821,7 @@ stage: Modified - name: Modified3425 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2920\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175842,7 +175842,7 @@ stage: Modified - name: Modified3426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2920\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2920\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175851,7 +175851,7 @@ stage: Modified - name: Modified3427 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2921\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175872,7 +175872,7 @@ stage: Modified - name: Modified3428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2921\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2921\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175881,7 +175881,7 @@ stage: Modified - name: Modified3429 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2922\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175902,7 +175902,7 @@ stage: Modified - name: Modified3430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2922\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2922\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175910,7 +175910,7 @@ stage: Modified - name: Modified3431 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2923\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175931,7 +175931,7 @@ stage: Modified - name: Modified3432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2923\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2923\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -175939,7 +175939,7 @@ stage: Modified - name: Modified3433 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2924\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175960,7 +175960,7 @@ stage: Modified - name: Modified3434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2924\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2924\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175969,7 +175969,7 @@ stage: Modified - name: Modified3435 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2925\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -175990,7 +175990,7 @@ stage: Modified - name: Modified3436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2925\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2925\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -175999,7 +175999,7 @@ stage: Modified - name: Modified3437 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2926\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176020,7 +176020,7 @@ stage: Modified - name: Modified3438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2926\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2926\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176028,7 +176028,7 @@ stage: Modified - name: Modified3439 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2927\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176049,7 +176049,7 @@ stage: Modified - name: Modified3440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2927\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2927\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176057,14 +176057,14 @@ stage: Modified - name: Modified3441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "mtime": 1606770041, "checksum": "55b9db4653c198c7f2ccff76b7cfa8c468155d5c"}}' stage: Modified - name: Modified3442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -176073,14 +176073,14 @@ stage: Modified - name: Modified3443 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "mtime": 1606770041, "checksum": "55b9db4653c198c7f2ccff76b7cfa8c468155d5c"}}' stage: Modified - name: Modified3444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -176089,14 +176089,14 @@ stage: Modified - name: Modified3445 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "mtime": 1606770041, "checksum": "55b9db4653c198c7f2ccff76b7cfa8c468155d5c"}}' stage: Modified - name: Modified3446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176104,14 +176104,14 @@ stage: Modified - name: Modified3447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "mtime": 1606770041, "checksum": "55b9db4653c198c7f2ccff76b7cfa8c468155d5c"}}' stage: Modified - name: Modified3448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176119,14 +176119,14 @@ stage: Modified - name: Modified3449 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "mtime": 1606770041, "checksum": "55b9db4653c198c7f2ccff76b7cfa8c468155d5c"}}' stage: Modified - name: Modified3450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -176135,14 +176135,14 @@ stage: Modified - name: Modified3451 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "mtime": 1606770041, "checksum": "55b9db4653c198c7f2ccff76b7cfa8c468155d5c"}}' stage: Modified - name: Modified3452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -176151,14 +176151,14 @@ stage: Modified - name: Modified3453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "mtime": 1606770041, "checksum": "55b9db4653c198c7f2ccff76b7cfa8c468155d5c"}}' stage: Modified - name: Modified3454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176166,14 +176166,14 @@ stage: Modified - name: Modified3455 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816941,"attributes":{"type":"registry_key","mtime":1606770041,"checksum":"55b9db4653c198c7f2ccff76b7cfa8c468155d5c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key", "arch": "[x64]", "timestamp": 1606816941, "attributes": {"type": "registry_key", "mtime": 1606770041, "checksum": "55b9db4653c198c7f2ccff76b7cfa8c468155d5c"}}' stage: Modified - name: Modified3456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176181,7 +176181,7 @@ stage: Modified - name: Modified3457 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2936\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2936\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -176190,7 +176190,7 @@ stage: Modified - name: Modified3458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2937\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816941,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2937\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816941, "attributes": @@ -176199,7 +176199,7 @@ stage: Modified - name: Modified3459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2938\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2938\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176207,7 +176207,7 @@ stage: Modified - name: Modified3460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2939\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2939\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176215,7 +176215,7 @@ stage: Modified - name: Modified3461 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2940\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2940\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": @@ -176224,7 +176224,7 @@ stage: Modified - name: Modified3462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2941\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2941\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": @@ -176233,7 +176233,7 @@ stage: Modified - name: Modified3463 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2942\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2942\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176241,7 +176241,7 @@ stage: Modified - name: Modified3464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2943\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","size":9,"hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["size","sha1"],"old_attributes":{"type":"registry_value","size":6,"hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2943\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "size": 9, "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176249,7 +176249,7 @@ stage: Modified - name: Modified3465 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176272,7 +176272,7 @@ stage: Modified - name: Modified3466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": @@ -176281,7 +176281,7 @@ stage: Modified - name: Modified3467 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176304,7 +176304,7 @@ stage: Modified - name: Modified3468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": @@ -176313,7 +176313,7 @@ stage: Modified - name: Modified3469 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176336,7 +176336,7 @@ stage: Modified - name: Modified3470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176344,7 +176344,7 @@ stage: Modified - name: Modified3471 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176367,7 +176367,7 @@ stage: Modified - name: Modified3472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176375,7 +176375,7 @@ stage: Modified - name: Modified3473 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176398,7 +176398,7 @@ stage: Modified - name: Modified3474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": @@ -176407,7 +176407,7 @@ stage: Modified - name: Modified3475 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176430,7 +176430,7 @@ stage: Modified - name: Modified3476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": @@ -176439,7 +176439,7 @@ stage: Modified - name: Modified3477 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176462,7 +176462,7 @@ stage: Modified - name: Modified3478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176470,7 +176470,7 @@ stage: Modified - name: Modified3479 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176493,7 +176493,7 @@ stage: Modified - name: Modified3480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176501,7 +176501,7 @@ stage: Modified - name: Modified3481 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2952\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176524,7 +176524,7 @@ stage: Modified - name: Modified3482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2952\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2952\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": @@ -176533,7 +176533,7 @@ stage: Modified - name: Modified3483 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2953\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176556,7 +176556,7 @@ stage: Modified - name: Modified3484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2953\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2953\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": @@ -176565,7 +176565,7 @@ stage: Modified - name: Modified3485 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2954\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176588,7 +176588,7 @@ stage: Modified - name: Modified3486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2954\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2954\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176596,7 +176596,7 @@ stage: Modified - name: Modified3487 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2955\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176619,7 +176619,7 @@ stage: Modified - name: Modified3488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2955\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2955\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176627,7 +176627,7 @@ stage: Modified - name: Modified3489 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2956\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176650,7 +176650,7 @@ stage: Modified - name: Modified3490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2956\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2956\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": @@ -176659,7 +176659,7 @@ stage: Modified - name: Modified3491 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2957\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176682,7 +176682,7 @@ stage: Modified - name: Modified3492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2957\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2957\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": @@ -176691,7 +176691,7 @@ stage: Modified - name: Modified3493 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2958\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176714,7 +176714,7 @@ stage: Modified - name: Modified3494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2958\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2958\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176722,7 +176722,7 @@ stage: Modified - name: Modified3495 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2959\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -176745,7 +176745,7 @@ stage: Modified - name: Modified3496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2959\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2959\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176753,7 +176753,7 @@ stage: Modified - name: Modified3497 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816942,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key", "arch": "[x64]", "timestamp": 1606816942, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176762,7 +176762,7 @@ stage: Modified - name: Modified3498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816942,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816942, "attributes": @@ -176771,7 +176771,7 @@ stage: Modified - name: Modified3499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176780,7 +176780,7 @@ stage: Modified - name: Modified3500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": @@ -176789,7 +176789,7 @@ stage: Modified - name: Modified3501 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176798,7 +176798,7 @@ stage: Modified - name: Modified3502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176806,7 +176806,7 @@ stage: Modified - name: Modified3503 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176815,7 +176815,7 @@ stage: Modified - name: Modified3504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176823,7 +176823,7 @@ stage: Modified - name: Modified3505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176832,7 +176832,7 @@ stage: Modified - name: Modified3506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": @@ -176841,7 +176841,7 @@ stage: Modified - name: Modified3507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176850,7 +176850,7 @@ stage: Modified - name: Modified3508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": @@ -176859,7 +176859,7 @@ stage: Modified - name: Modified3509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176868,7 +176868,7 @@ stage: Modified - name: Modified3510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176876,7 +176876,7 @@ stage: Modified - name: Modified3511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770041,"checksum":"713d9166575f5146526ed0af76767373157ba8fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176885,7 +176885,7 @@ stage: Modified - name: Modified3512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176893,7 +176893,7 @@ stage: Modified - name: Modified3513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176902,7 +176902,7 @@ stage: Modified - name: Modified3514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2968\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": @@ -176911,7 +176911,7 @@ stage: Modified - name: Modified3515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176920,7 +176920,7 @@ stage: Modified - name: Modified3516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2969\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": @@ -176929,7 +176929,7 @@ stage: Modified - name: Modified3517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176938,7 +176938,7 @@ stage: Modified - name: Modified3518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2970\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176946,7 +176946,7 @@ stage: Modified - name: Modified3519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176955,7 +176955,7 @@ stage: Modified - name: Modified3520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2971\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -176963,7 +176963,7 @@ stage: Modified - name: Modified3521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176972,7 +176972,7 @@ stage: Modified - name: Modified3522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2972\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": @@ -176981,7 +176981,7 @@ stage: Modified - name: Modified3523 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816952,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key", "arch": "[x64]", "timestamp": 1606816952, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -176990,7 +176990,7 @@ stage: Modified - name: Modified3524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816952,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2973\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816952, "attributes": @@ -176999,7 +176999,7 @@ stage: Modified - name: Modified3525 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177008,7 +177008,7 @@ stage: Modified - name: Modified3526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2974\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177016,7 +177016,7 @@ stage: Modified - name: Modified3527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177025,7 +177025,7 @@ stage: Modified - name: Modified3528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2975\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177033,7 +177033,7 @@ stage: Modified - name: Modified3529 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177055,7 +177055,7 @@ stage: Modified - name: Modified3530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177064,7 +177064,7 @@ stage: Modified - name: Modified3531 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177086,7 +177086,7 @@ stage: Modified - name: Modified3532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177095,7 +177095,7 @@ stage: Modified - name: Modified3533 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177117,7 +177117,7 @@ stage: Modified - name: Modified3534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177125,7 +177125,7 @@ stage: Modified - name: Modified3535 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177147,7 +177147,7 @@ stage: Modified - name: Modified3536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177155,7 +177155,7 @@ stage: Modified - name: Modified3537 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177177,7 +177177,7 @@ stage: Modified - name: Modified3538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177186,7 +177186,7 @@ stage: Modified - name: Modified3539 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177208,7 +177208,7 @@ stage: Modified - name: Modified3540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177217,7 +177217,7 @@ stage: Modified - name: Modified3541 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177239,7 +177239,7 @@ stage: Modified - name: Modified3542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177247,7 +177247,7 @@ stage: Modified - name: Modified3543 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177269,7 +177269,7 @@ stage: Modified - name: Modified3544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177277,7 +177277,7 @@ stage: Modified - name: Modified3545 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2984\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177299,7 +177299,7 @@ stage: Modified - name: Modified3546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2984\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2984\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177308,7 +177308,7 @@ stage: Modified - name: Modified3547 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2985\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177330,7 +177330,7 @@ stage: Modified - name: Modified3548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2985\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2985\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177339,7 +177339,7 @@ stage: Modified - name: Modified3549 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2986\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177361,7 +177361,7 @@ stage: Modified - name: Modified3550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2986\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2986\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177369,7 +177369,7 @@ stage: Modified - name: Modified3551 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2987\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177391,7 +177391,7 @@ stage: Modified - name: Modified3552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2987\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2987\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177399,7 +177399,7 @@ stage: Modified - name: Modified3553 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2988\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177421,7 +177421,7 @@ stage: Modified - name: Modified3554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2988\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2988\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177430,7 +177430,7 @@ stage: Modified - name: Modified3555 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2989\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177452,7 +177452,7 @@ stage: Modified - name: Modified3556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2989\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2989\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177461,7 +177461,7 @@ stage: Modified - name: Modified3557 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2990\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177483,7 +177483,7 @@ stage: Modified - name: Modified3558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2990\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2990\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177491,7 +177491,7 @@ stage: Modified - name: Modified3559 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2991\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177513,7 +177513,7 @@ stage: Modified - name: Modified3560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2991\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2991\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177521,7 +177521,7 @@ stage: Modified - name: Modified3561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177529,7 +177529,7 @@ stage: Modified - name: Modified3562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177538,7 +177538,7 @@ stage: Modified - name: Modified3563 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177546,7 +177546,7 @@ stage: Modified - name: Modified3564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177555,7 +177555,7 @@ stage: Modified - name: Modified3565 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177563,7 +177563,7 @@ stage: Modified - name: Modified3566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177571,7 +177571,7 @@ stage: Modified - name: Modified3567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177579,7 +177579,7 @@ stage: Modified - name: Modified3568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177587,7 +177587,7 @@ stage: Modified - name: Modified3569 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177595,7 +177595,7 @@ stage: Modified - name: Modified3570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177604,7 +177604,7 @@ stage: Modified - name: Modified3571 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177612,7 +177612,7 @@ stage: Modified - name: Modified3572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177621,7 +177621,7 @@ stage: Modified - name: Modified3573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177629,7 +177629,7 @@ stage: Modified - name: Modified3574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177637,7 +177637,7 @@ stage: Modified - name: Modified3575 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770042,"checksum":"7a9c158e60fb1d36da458069a235063d101fcafb"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177645,7 +177645,7 @@ stage: Modified - name: Modified3576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177653,7 +177653,7 @@ stage: Modified - name: Modified3577 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177661,7 +177661,7 @@ stage: Modified - name: Modified3578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3000\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177670,7 +177670,7 @@ stage: Modified - name: Modified3579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177678,7 +177678,7 @@ stage: Modified - name: Modified3580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3001\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177687,7 +177687,7 @@ stage: Modified - name: Modified3581 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177695,7 +177695,7 @@ stage: Modified - name: Modified3582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3002\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177703,7 +177703,7 @@ stage: Modified - name: Modified3583 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177711,7 +177711,7 @@ stage: Modified - name: Modified3584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3003\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177719,7 +177719,7 @@ stage: Modified - name: Modified3585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177727,7 +177727,7 @@ stage: Modified - name: Modified3586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3004\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177736,7 +177736,7 @@ stage: Modified - name: Modified3587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177744,7 +177744,7 @@ stage: Modified - name: Modified3588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3005\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177753,7 +177753,7 @@ stage: Modified - name: Modified3589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177761,7 +177761,7 @@ stage: Modified - name: Modified3590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3006\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177769,7 +177769,7 @@ stage: Modified - name: Modified3591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key", "arch": "[x64]", "timestamp": 1606816953, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -177777,7 +177777,7 @@ stage: Modified - name: Modified3592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3007\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177785,7 +177785,7 @@ stage: Modified - name: Modified3593 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177807,7 +177807,7 @@ stage: Modified - name: Modified3594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177816,7 +177816,7 @@ stage: Modified - name: Modified3595 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177838,7 +177838,7 @@ stage: Modified - name: Modified3596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177847,7 +177847,7 @@ stage: Modified - name: Modified3597 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177869,7 +177869,7 @@ stage: Modified - name: Modified3598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177877,7 +177877,7 @@ stage: Modified - name: Modified3599 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177899,7 +177899,7 @@ stage: Modified - name: Modified3600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177907,7 +177907,7 @@ stage: Modified - name: Modified3601 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177929,7 +177929,7 @@ stage: Modified - name: Modified3602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177938,7 +177938,7 @@ stage: Modified - name: Modified3603 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816953,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177960,7 +177960,7 @@ stage: Modified - name: Modified3604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816953,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816953, "attributes": @@ -177969,7 +177969,7 @@ stage: Modified - name: Modified3605 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -177991,7 +177991,7 @@ stage: Modified - name: Modified3606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -177999,7 +177999,7 @@ stage: Modified - name: Modified3607 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178021,7 +178021,7 @@ stage: Modified - name: Modified3608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178029,7 +178029,7 @@ stage: Modified - name: Modified3609 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3016\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178051,7 +178051,7 @@ stage: Modified - name: Modified3610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3016\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3016\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178060,7 +178060,7 @@ stage: Modified - name: Modified3611 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3017\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178082,7 +178082,7 @@ stage: Modified - name: Modified3612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3017\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3017\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178091,7 +178091,7 @@ stage: Modified - name: Modified3613 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3018\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178113,7 +178113,7 @@ stage: Modified - name: Modified3614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3018\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3018\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178121,7 +178121,7 @@ stage: Modified - name: Modified3615 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3019\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178143,7 +178143,7 @@ stage: Modified - name: Modified3616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3019\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3019\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178151,7 +178151,7 @@ stage: Modified - name: Modified3617 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3020\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178173,7 +178173,7 @@ stage: Modified - name: Modified3618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3020\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3020\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178182,7 +178182,7 @@ stage: Modified - name: Modified3619 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3021\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178204,7 +178204,7 @@ stage: Modified - name: Modified3620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3021\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3021\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178213,7 +178213,7 @@ stage: Modified - name: Modified3621 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3022\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178235,7 +178235,7 @@ stage: Modified - name: Modified3622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3022\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3022\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178243,7 +178243,7 @@ stage: Modified - name: Modified3623 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3023\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178265,7 +178265,7 @@ stage: Modified - name: Modified3624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3023\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3023\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178273,7 +178273,7 @@ stage: Modified - name: Modified3625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770042,"checksum":"0e06c263493377a520dec7abeffbe381111fcde4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770042,"checksum":"0e06c263493377a520dec7abeffbe381111fcde4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key", "arch": "[x64]", "timestamp": 1606816954, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -178281,7 +178281,7 @@ stage: Modified - name: Modified3626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178290,7 +178290,7 @@ stage: Modified - name: Modified3627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770042,"checksum":"0e06c263493377a520dec7abeffbe381111fcde4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770042,"checksum":"0e06c263493377a520dec7abeffbe381111fcde4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key", "arch": "[x64]", "timestamp": 1606816954, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -178298,7 +178298,7 @@ stage: Modified - name: Modified3628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178307,7 +178307,7 @@ stage: Modified - name: Modified3629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770042,"checksum":"0e06c263493377a520dec7abeffbe381111fcde4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770042,"checksum":"0e06c263493377a520dec7abeffbe381111fcde4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key", "arch": "[x64]", "timestamp": 1606816954, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -178315,7 +178315,7 @@ stage: Modified - name: Modified3630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178323,7 +178323,7 @@ stage: Modified - name: Modified3631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770042,"checksum":"0e06c263493377a520dec7abeffbe381111fcde4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770042,"checksum":"0e06c263493377a520dec7abeffbe381111fcde4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key", "arch": "[x64]", "timestamp": 1606816954, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -178331,7 +178331,7 @@ stage: Modified - name: Modified3632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178339,7 +178339,7 @@ stage: Modified - name: Modified3633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770042,"checksum":"0e06c263493377a520dec7abeffbe381111fcde4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770042,"checksum":"0e06c263493377a520dec7abeffbe381111fcde4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key", "arch": "[x64]", "timestamp": 1606816954, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -178347,7 +178347,7 @@ stage: Modified - name: Modified3634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178356,7 +178356,7 @@ stage: Modified - name: Modified3635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770043,"checksum":"762db120f6200a480d81441c9b2bf67b7369f568"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770043,"checksum":"762db120f6200a480d81441c9b2bf67b7369f568"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key", "arch": "[x64]", "timestamp": 1606816954, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -178364,7 +178364,7 @@ stage: Modified - name: Modified3636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178373,7 +178373,7 @@ stage: Modified - name: Modified3637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770043,"checksum":"762db120f6200a480d81441c9b2bf67b7369f568"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770043,"checksum":"762db120f6200a480d81441c9b2bf67b7369f568"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key", "arch": "[x64]", "timestamp": 1606816954, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -178381,7 +178381,7 @@ stage: Modified - name: Modified3638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178389,7 +178389,7 @@ stage: Modified - name: Modified3639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770043,"checksum":"762db120f6200a480d81441c9b2bf67b7369f568"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770043,"checksum":"762db120f6200a480d81441c9b2bf67b7369f568"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key", "arch": "[x64]", "timestamp": 1606816954, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -178397,7 +178397,7 @@ stage: Modified - name: Modified3640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178405,7 +178405,7 @@ stage: Modified - name: Modified3641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3032\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3032\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178414,7 +178414,7 @@ stage: Modified - name: Modified3642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3033\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3033\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178423,7 +178423,7 @@ stage: Modified - name: Modified3643 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3034\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3034\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178431,7 +178431,7 @@ stage: Modified - name: Modified3644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3035\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3035\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178439,7 +178439,7 @@ stage: Modified - name: Modified3645 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3036\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3036\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178448,7 +178448,7 @@ stage: Modified - name: Modified3646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3037\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3037\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178457,7 +178457,7 @@ stage: Modified - name: Modified3647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3038\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3038\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178465,7 +178465,7 @@ stage: Modified - name: Modified3648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3039\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3039\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178473,7 +178473,7 @@ stage: Modified - name: Modified3649 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178494,7 +178494,7 @@ stage: Modified - name: Modified3650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178503,7 +178503,7 @@ stage: Modified - name: Modified3651 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178524,7 +178524,7 @@ stage: Modified - name: Modified3652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178533,7 +178533,7 @@ stage: Modified - name: Modified3653 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178554,7 +178554,7 @@ stage: Modified - name: Modified3654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178562,7 +178562,7 @@ stage: Modified - name: Modified3655 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178583,7 +178583,7 @@ stage: Modified - name: Modified3656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178591,7 +178591,7 @@ stage: Modified - name: Modified3657 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178612,7 +178612,7 @@ stage: Modified - name: Modified3658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178621,7 +178621,7 @@ stage: Modified - name: Modified3659 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178642,7 +178642,7 @@ stage: Modified - name: Modified3660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178651,7 +178651,7 @@ stage: Modified - name: Modified3661 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178672,7 +178672,7 @@ stage: Modified - name: Modified3662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178680,7 +178680,7 @@ stage: Modified - name: Modified3663 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178701,7 +178701,7 @@ stage: Modified - name: Modified3664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178709,7 +178709,7 @@ stage: Modified - name: Modified3665 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3048\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178730,7 +178730,7 @@ stage: Modified - name: Modified3666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3048\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3048\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178739,7 +178739,7 @@ stage: Modified - name: Modified3667 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3049\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178760,7 +178760,7 @@ stage: Modified - name: Modified3668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3049\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3049\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178769,7 +178769,7 @@ stage: Modified - name: Modified3669 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3050\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178790,7 +178790,7 @@ stage: Modified - name: Modified3670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3050\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3050\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178798,7 +178798,7 @@ stage: Modified - name: Modified3671 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3051\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178819,7 +178819,7 @@ stage: Modified - name: Modified3672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3051\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3051\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178827,7 +178827,7 @@ stage: Modified - name: Modified3673 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3052\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816954,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178848,7 +178848,7 @@ stage: Modified - name: Modified3674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3052\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816954,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3052\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816954, "attributes": @@ -178857,7 +178857,7 @@ stage: Modified - name: Modified3675 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3053\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178878,7 +178878,7 @@ stage: Modified - name: Modified3676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3053\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3053\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -178887,7 +178887,7 @@ stage: Modified - name: Modified3677 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3054\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178908,7 +178908,7 @@ stage: Modified - name: Modified3678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3054\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3054\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178916,7 +178916,7 @@ stage: Modified - name: Modified3679 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3055\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -178937,7 +178937,7 @@ stage: Modified - name: Modified3680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3055\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3055\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178945,14 +178945,14 @@ stage: Modified - name: Modified3681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key", "arch": "[x64]", "timestamp": 1606816955, "attributes": {"type": "registry_key", "mtime": 1606770043, "checksum": "37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"}}' stage: Modified - name: Modified3682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -178961,14 +178961,14 @@ stage: Modified - name: Modified3683 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key", "arch": "[x64]", "timestamp": 1606816955, "attributes": {"type": "registry_key", "mtime": 1606770043, "checksum": "37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"}}' stage: Modified - name: Modified3684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -178977,14 +178977,14 @@ stage: Modified - name: Modified3685 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key", "arch": "[x64]", "timestamp": 1606816955, "attributes": {"type": "registry_key", "mtime": 1606770043, "checksum": "37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"}}' stage: Modified - name: Modified3686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -178992,14 +178992,14 @@ stage: Modified - name: Modified3687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key", "arch": "[x64]", "timestamp": 1606816955, "attributes": {"type": "registry_key", "mtime": 1606770043, "checksum": "37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"}}' stage: Modified - name: Modified3688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -179007,14 +179007,14 @@ stage: Modified - name: Modified3689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key", "arch": "[x64]", "timestamp": 1606816955, "attributes": {"type": "registry_key", "mtime": 1606770043, "checksum": "37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"}}' stage: Modified - name: Modified3690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179023,14 +179023,14 @@ stage: Modified - name: Modified3691 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key", "arch": "[x64]", "timestamp": 1606816955, "attributes": {"type": "registry_key", "mtime": 1606770043, "checksum": "37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"}}' stage: Modified - name: Modified3692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179039,14 +179039,14 @@ stage: Modified - name: Modified3693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key", "arch": "[x64]", "timestamp": 1606816955, "attributes": {"type": "registry_key", "mtime": 1606770043, "checksum": "37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"}}' stage: Modified - name: Modified3694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -179054,14 +179054,14 @@ stage: Modified - name: Modified3695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","mtime":1606770043,"checksum":"37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key", "arch": "[x64]", "timestamp": 1606816955, "attributes": {"type": "registry_key", "mtime": 1606770043, "checksum": "37c5c63b4e93ebb50a6b1319f1e2e121b8a0dbc9"}}' stage: Modified - name: Modified3696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -179069,7 +179069,7 @@ stage: Modified - name: Modified3697 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3064\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3064\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179078,7 +179078,7 @@ stage: Modified - name: Modified3698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3065\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3065\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179087,7 +179087,7 @@ stage: Modified - name: Modified3699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3066\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3066\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -179095,7 +179095,7 @@ stage: Modified - name: Modified3700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3067\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3067\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -179103,7 +179103,7 @@ stage: Modified - name: Modified3701 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3068\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3068\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179112,7 +179112,7 @@ stage: Modified - name: Modified3702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3069\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3069\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179121,7 +179121,7 @@ stage: Modified - name: Modified3703 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3070\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3070\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -179129,7 +179129,7 @@ stage: Modified - name: Modified3704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3071\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"74212ca7983c3c216483ea2b3c3ed147e949de82"},"changed_attributes":["sha1"],"old_attributes":{"type":"registry_value","hash_sha1":"172415f02e562cd029620c3db12fb3cbb83c4208","checksum":"1fd371f1f4922e1744d0c698d9540dda85a34c72"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3071\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "hash_sha1": "99db324742823c55d975b605e1fc22f4253a9b7d", @@ -179137,7 +179137,7 @@ stage: Modified - name: Modified3705 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179160,7 +179160,7 @@ stage: Modified - name: Modified3706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179170,7 +179170,7 @@ stage: Modified - name: Modified3707 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179193,7 +179193,7 @@ stage: Modified - name: Modified3708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179203,7 +179203,7 @@ stage: Modified - name: Modified3709 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179226,7 +179226,7 @@ stage: Modified - name: Modified3710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179235,7 +179235,7 @@ stage: Modified - name: Modified3711 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179258,7 +179258,7 @@ stage: Modified - name: Modified3712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179267,7 +179267,7 @@ stage: Modified - name: Modified3713 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179290,7 +179290,7 @@ stage: Modified - name: Modified3714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179300,7 +179300,7 @@ stage: Modified - name: Modified3715 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179323,7 +179323,7 @@ stage: Modified - name: Modified3716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179333,7 +179333,7 @@ stage: Modified - name: Modified3717 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179356,7 +179356,7 @@ stage: Modified - name: Modified3718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179365,7 +179365,7 @@ stage: Modified - name: Modified3719 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179388,7 +179388,7 @@ stage: Modified - name: Modified3720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179397,7 +179397,7 @@ stage: Modified - name: Modified3721 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3080\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179420,7 +179420,7 @@ stage: Modified - name: Modified3722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3080\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3080\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179430,7 +179430,7 @@ stage: Modified - name: Modified3723 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3081\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179453,7 +179453,7 @@ stage: Modified - name: Modified3724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3081\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3081\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179463,7 +179463,7 @@ stage: Modified - name: Modified3725 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3082\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179486,7 +179486,7 @@ stage: Modified - name: Modified3726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3082\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3082\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179495,7 +179495,7 @@ stage: Modified - name: Modified3727 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3083\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179518,7 +179518,7 @@ stage: Modified - name: Modified3728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3083\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3083\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179527,7 +179527,7 @@ stage: Modified - name: Modified3729 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3084\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179550,7 +179550,7 @@ stage: Modified - name: Modified3730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3084\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3084\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179560,7 +179560,7 @@ stage: Modified - name: Modified3731 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3085\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179583,7 +179583,7 @@ stage: Modified - name: Modified3732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3085\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3085\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179593,7 +179593,7 @@ stage: Modified - name: Modified3733 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3086\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179616,7 +179616,7 @@ stage: Modified - name: Modified3734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3086\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3086\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179625,7 +179625,7 @@ stage: Modified - name: Modified3735 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3087\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179648,7 +179648,7 @@ stage: Modified - name: Modified3736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3087\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3087\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179657,7 +179657,7 @@ stage: Modified - name: Modified3737 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key", "arch": "[x64]", "timestamp": 1606816955, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179666,7 +179666,7 @@ stage: Modified - name: Modified3738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179676,7 +179676,7 @@ stage: Modified - name: Modified3739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816955,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key", "arch": "[x64]", "timestamp": 1606816955, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179685,7 +179685,7 @@ stage: Modified - name: Modified3740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816955,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816955, "attributes": @@ -179695,7 +179695,7 @@ stage: Modified - name: Modified3741 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179704,7 +179704,7 @@ stage: Modified - name: Modified3742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179713,7 +179713,7 @@ stage: Modified - name: Modified3743 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179722,7 +179722,7 @@ stage: Modified - name: Modified3744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179731,7 +179731,7 @@ stage: Modified - name: Modified3745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179740,7 +179740,7 @@ stage: Modified - name: Modified3746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -179750,7 +179750,7 @@ stage: Modified - name: Modified3747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179759,7 +179759,7 @@ stage: Modified - name: Modified3748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -179769,7 +179769,7 @@ stage: Modified - name: Modified3749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179778,7 +179778,7 @@ stage: Modified - name: Modified3750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179787,7 +179787,7 @@ stage: Modified - name: Modified3751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770044,"checksum":"c34e59c05f28c8e881b4eded82a5368a13e15bf0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179796,7 +179796,7 @@ stage: Modified - name: Modified3752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179805,7 +179805,7 @@ stage: Modified - name: Modified3753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179814,7 +179814,7 @@ stage: Modified - name: Modified3754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3096\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -179824,7 +179824,7 @@ stage: Modified - name: Modified3755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179833,7 +179833,7 @@ stage: Modified - name: Modified3756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3097\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -179843,7 +179843,7 @@ stage: Modified - name: Modified3757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179852,7 +179852,7 @@ stage: Modified - name: Modified3758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3098\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179861,7 +179861,7 @@ stage: Modified - name: Modified3759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179870,7 +179870,7 @@ stage: Modified - name: Modified3760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3099\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179879,7 +179879,7 @@ stage: Modified - name: Modified3761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179888,7 +179888,7 @@ stage: Modified - name: Modified3762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3100\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -179898,7 +179898,7 @@ stage: Modified - name: Modified3763 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179907,7 +179907,7 @@ stage: Modified - name: Modified3764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3101\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -179917,7 +179917,7 @@ stage: Modified - name: Modified3765 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179926,7 +179926,7 @@ stage: Modified - name: Modified3766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3102\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179935,7 +179935,7 @@ stage: Modified - name: Modified3767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -179944,7 +179944,7 @@ stage: Modified - name: Modified3768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3103\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -179953,7 +179953,7 @@ stage: Modified - name: Modified3769 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -179975,7 +179975,7 @@ stage: Modified - name: Modified3770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -179985,7 +179985,7 @@ stage: Modified - name: Modified3771 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180007,7 +180007,7 @@ stage: Modified - name: Modified3772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180017,7 +180017,7 @@ stage: Modified - name: Modified3773 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180039,7 +180039,7 @@ stage: Modified - name: Modified3774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180048,7 +180048,7 @@ stage: Modified - name: Modified3775 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180070,7 +180070,7 @@ stage: Modified - name: Modified3776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180079,7 +180079,7 @@ stage: Modified - name: Modified3777 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180101,7 +180101,7 @@ stage: Modified - name: Modified3778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180111,7 +180111,7 @@ stage: Modified - name: Modified3779 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180133,7 +180133,7 @@ stage: Modified - name: Modified3780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180143,7 +180143,7 @@ stage: Modified - name: Modified3781 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180165,7 +180165,7 @@ stage: Modified - name: Modified3782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180174,7 +180174,7 @@ stage: Modified - name: Modified3783 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180196,7 +180196,7 @@ stage: Modified - name: Modified3784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180205,7 +180205,7 @@ stage: Modified - name: Modified3785 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3112\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180227,7 +180227,7 @@ stage: Modified - name: Modified3786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3112\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3112\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180237,7 +180237,7 @@ stage: Modified - name: Modified3787 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3113\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180259,7 +180259,7 @@ stage: Modified - name: Modified3788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3113\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3113\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180269,7 +180269,7 @@ stage: Modified - name: Modified3789 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3114\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180291,7 +180291,7 @@ stage: Modified - name: Modified3790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3114\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3114\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180300,7 +180300,7 @@ stage: Modified - name: Modified3791 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3115\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180322,7 +180322,7 @@ stage: Modified - name: Modified3792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3115\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3115\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180331,7 +180331,7 @@ stage: Modified - name: Modified3793 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3116\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180353,7 +180353,7 @@ stage: Modified - name: Modified3794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3116\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3116\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180363,7 +180363,7 @@ stage: Modified - name: Modified3795 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3117\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180385,7 +180385,7 @@ stage: Modified - name: Modified3796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3117\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3117\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180395,7 +180395,7 @@ stage: Modified - name: Modified3797 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3118\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180417,7 +180417,7 @@ stage: Modified - name: Modified3798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3118\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3118\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180426,7 +180426,7 @@ stage: Modified - name: Modified3799 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3119\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180448,7 +180448,7 @@ stage: Modified - name: Modified3800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3119\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3119\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180457,7 +180457,7 @@ stage: Modified - name: Modified3801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180465,7 +180465,7 @@ stage: Modified - name: Modified3802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180475,7 +180475,7 @@ stage: Modified - name: Modified3803 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180483,7 +180483,7 @@ stage: Modified - name: Modified3804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180493,7 +180493,7 @@ stage: Modified - name: Modified3805 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180501,7 +180501,7 @@ stage: Modified - name: Modified3806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180510,7 +180510,7 @@ stage: Modified - name: Modified3807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180518,7 +180518,7 @@ stage: Modified - name: Modified3808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180527,7 +180527,7 @@ stage: Modified - name: Modified3809 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180535,7 +180535,7 @@ stage: Modified - name: Modified3810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180545,7 +180545,7 @@ stage: Modified - name: Modified3811 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180553,7 +180553,7 @@ stage: Modified - name: Modified3812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180563,7 +180563,7 @@ stage: Modified - name: Modified3813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180571,7 +180571,7 @@ stage: Modified - name: Modified3814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180580,7 +180580,7 @@ stage: Modified - name: Modified3815 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770044,"checksum":"214c81f5b8366da756123d4985d0f7cbe481c20e"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180588,7 +180588,7 @@ stage: Modified - name: Modified3816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180597,7 +180597,7 @@ stage: Modified - name: Modified3817 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180605,7 +180605,7 @@ stage: Modified - name: Modified3818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3128\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180615,7 +180615,7 @@ stage: Modified - name: Modified3819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816956,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key", "arch": "[x64]", "timestamp": 1606816956, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180623,7 +180623,7 @@ stage: Modified - name: Modified3820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816956,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3129\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816956, "attributes": @@ -180633,7 +180633,7 @@ stage: Modified - name: Modified3821 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180641,7 +180641,7 @@ stage: Modified - name: Modified3822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3130\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180650,7 +180650,7 @@ stage: Modified - name: Modified3823 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180658,7 +180658,7 @@ stage: Modified - name: Modified3824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3131\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180667,7 +180667,7 @@ stage: Modified - name: Modified3825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180675,7 +180675,7 @@ stage: Modified - name: Modified3826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3132\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -180685,7 +180685,7 @@ stage: Modified - name: Modified3827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180693,7 +180693,7 @@ stage: Modified - name: Modified3828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3133\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -180703,7 +180703,7 @@ stage: Modified - name: Modified3829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180711,7 +180711,7 @@ stage: Modified - name: Modified3830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3134\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180720,7 +180720,7 @@ stage: Modified - name: Modified3831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -180728,7 +180728,7 @@ stage: Modified - name: Modified3832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3135\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180737,7 +180737,7 @@ stage: Modified - name: Modified3833 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180759,7 +180759,7 @@ stage: Modified - name: Modified3834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -180769,7 +180769,7 @@ stage: Modified - name: Modified3835 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180791,7 +180791,7 @@ stage: Modified - name: Modified3836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -180801,7 +180801,7 @@ stage: Modified - name: Modified3837 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180823,7 +180823,7 @@ stage: Modified - name: Modified3838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180832,7 +180832,7 @@ stage: Modified - name: Modified3839 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180854,7 +180854,7 @@ stage: Modified - name: Modified3840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180863,7 +180863,7 @@ stage: Modified - name: Modified3841 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180885,7 +180885,7 @@ stage: Modified - name: Modified3842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -180895,7 +180895,7 @@ stage: Modified - name: Modified3843 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180917,7 +180917,7 @@ stage: Modified - name: Modified3844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -180927,7 +180927,7 @@ stage: Modified - name: Modified3845 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180949,7 +180949,7 @@ stage: Modified - name: Modified3846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180958,7 +180958,7 @@ stage: Modified - name: Modified3847 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -180980,7 +180980,7 @@ stage: Modified - name: Modified3848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -180989,7 +180989,7 @@ stage: Modified - name: Modified3849 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3144\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181011,7 +181011,7 @@ stage: Modified - name: Modified3850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3144\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3144\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181021,7 +181021,7 @@ stage: Modified - name: Modified3851 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3145\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181043,7 +181043,7 @@ stage: Modified - name: Modified3852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3145\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3145\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181053,7 +181053,7 @@ stage: Modified - name: Modified3853 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3146\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181075,7 +181075,7 @@ stage: Modified - name: Modified3854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3146\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3146\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181084,7 +181084,7 @@ stage: Modified - name: Modified3855 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3147\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181106,7 +181106,7 @@ stage: Modified - name: Modified3856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3147\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3147\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181115,7 +181115,7 @@ stage: Modified - name: Modified3857 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3148\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181137,7 +181137,7 @@ stage: Modified - name: Modified3858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3148\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3148\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181147,7 +181147,7 @@ stage: Modified - name: Modified3859 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3149\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181169,7 +181169,7 @@ stage: Modified - name: Modified3860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3149\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3149\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181179,7 +181179,7 @@ stage: Modified - name: Modified3861 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3150\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181201,7 +181201,7 @@ stage: Modified - name: Modified3862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3150\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3150\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181210,7 +181210,7 @@ stage: Modified - name: Modified3863 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3151\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181232,7 +181232,7 @@ stage: Modified - name: Modified3864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3151\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3151\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181241,7 +181241,7 @@ stage: Modified - name: Modified3865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -181249,7 +181249,7 @@ stage: Modified - name: Modified3866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181259,7 +181259,7 @@ stage: Modified - name: Modified3867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -181267,7 +181267,7 @@ stage: Modified - name: Modified3868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181277,7 +181277,7 @@ stage: Modified - name: Modified3869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -181285,7 +181285,7 @@ stage: Modified - name: Modified3870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181294,7 +181294,7 @@ stage: Modified - name: Modified3871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -181302,7 +181302,7 @@ stage: Modified - name: Modified3872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181311,7 +181311,7 @@ stage: Modified - name: Modified3873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -181319,7 +181319,7 @@ stage: Modified - name: Modified3874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181329,7 +181329,7 @@ stage: Modified - name: Modified3875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -181337,7 +181337,7 @@ stage: Modified - name: Modified3876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181347,7 +181347,7 @@ stage: Modified - name: Modified3877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -181355,7 +181355,7 @@ stage: Modified - name: Modified3878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181364,7 +181364,7 @@ stage: Modified - name: Modified3879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816957,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770045,"checksum":"03c81bd378650ec232234a42f0b179c052689594"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key", "arch": "[x64]", "timestamp": 1606816957, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -181372,7 +181372,7 @@ stage: Modified - name: Modified3880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181381,7 +181381,7 @@ stage: Modified - name: Modified3881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3160\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3160\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181391,7 +181391,7 @@ stage: Modified - name: Modified3882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3161\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3161\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181401,7 +181401,7 @@ stage: Modified - name: Modified3883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3162\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3162\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181410,7 +181410,7 @@ stage: Modified - name: Modified3884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3163\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3163\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181419,7 +181419,7 @@ stage: Modified - name: Modified3885 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3164\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3164\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181429,7 +181429,7 @@ stage: Modified - name: Modified3886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3165\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3165\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": @@ -181439,7 +181439,7 @@ stage: Modified - name: Modified3887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3166\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3166\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181448,7 +181448,7 @@ stage: Modified - name: Modified3888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3167\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816957,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3167\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816957, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181457,7 +181457,7 @@ stage: Modified - name: Modified3889 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181478,7 +181478,7 @@ stage: Modified - name: Modified3890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -181488,7 +181488,7 @@ stage: Modified - name: Modified3891 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181509,7 +181509,7 @@ stage: Modified - name: Modified3892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -181519,7 +181519,7 @@ stage: Modified - name: Modified3893 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181540,7 +181540,7 @@ stage: Modified - name: Modified3894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181549,7 +181549,7 @@ stage: Modified - name: Modified3895 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181570,7 +181570,7 @@ stage: Modified - name: Modified3896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181579,7 +181579,7 @@ stage: Modified - name: Modified3897 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181600,7 +181600,7 @@ stage: Modified - name: Modified3898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -181610,7 +181610,7 @@ stage: Modified - name: Modified3899 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181631,7 +181631,7 @@ stage: Modified - name: Modified3900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -181641,7 +181641,7 @@ stage: Modified - name: Modified3901 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181662,7 +181662,7 @@ stage: Modified - name: Modified3902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181671,7 +181671,7 @@ stage: Modified - name: Modified3903 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181692,7 +181692,7 @@ stage: Modified - name: Modified3904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181701,7 +181701,7 @@ stage: Modified - name: Modified3905 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3176\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181722,7 +181722,7 @@ stage: Modified - name: Modified3906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3176\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3176\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -181732,7 +181732,7 @@ stage: Modified - name: Modified3907 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3177\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181753,7 +181753,7 @@ stage: Modified - name: Modified3908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3177\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3177\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -181763,7 +181763,7 @@ stage: Modified - name: Modified3909 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3178\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181784,7 +181784,7 @@ stage: Modified - name: Modified3910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3178\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3178\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181793,7 +181793,7 @@ stage: Modified - name: Modified3911 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3179\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181814,7 +181814,7 @@ stage: Modified - name: Modified3912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3179\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3179\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181823,7 +181823,7 @@ stage: Modified - name: Modified3913 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3180\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181844,7 +181844,7 @@ stage: Modified - name: Modified3914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3180\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3180\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -181854,7 +181854,7 @@ stage: Modified - name: Modified3915 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3181\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181875,7 +181875,7 @@ stage: Modified - name: Modified3916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3181\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3181\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -181885,7 +181885,7 @@ stage: Modified - name: Modified3917 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3182\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181906,7 +181906,7 @@ stage: Modified - name: Modified3918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3182\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3182\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181915,7 +181915,7 @@ stage: Modified - name: Modified3919 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3183\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -181936,7 +181936,7 @@ stage: Modified - name: Modified3920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3183\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3183\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181945,14 +181945,14 @@ stage: Modified - name: Modified3921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key", "arch": "[x64]", "timestamp": 1606816958, "attributes": {"type": "registry_key", "mtime": 1606770045, "checksum": "8b83c264932a1f253ac9e60a3c7417b19337dfe7"}}' stage: Modified - name: Modified3922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -181962,14 +181962,14 @@ stage: Modified - name: Modified3923 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key", "arch": "[x64]", "timestamp": 1606816958, "attributes": {"type": "registry_key", "mtime": 1606770045, "checksum": "8b83c264932a1f253ac9e60a3c7417b19337dfe7"}}' stage: Modified - name: Modified3924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -181979,14 +181979,14 @@ stage: Modified - name: Modified3925 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key", "arch": "[x64]", "timestamp": 1606816958, "attributes": {"type": "registry_key", "mtime": 1606770045, "checksum": "8b83c264932a1f253ac9e60a3c7417b19337dfe7"}}' stage: Modified - name: Modified3926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -181995,14 +181995,14 @@ stage: Modified - name: Modified3927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key", "arch": "[x64]", "timestamp": 1606816958, "attributes": {"type": "registry_key", "mtime": 1606770045, "checksum": "8b83c264932a1f253ac9e60a3c7417b19337dfe7"}}' stage: Modified - name: Modified3928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182011,14 +182011,14 @@ stage: Modified - name: Modified3929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key", "arch": "[x64]", "timestamp": 1606816958, "attributes": {"type": "registry_key", "mtime": 1606770045, "checksum": "8b83c264932a1f253ac9e60a3c7417b19337dfe7"}}' stage: Modified - name: Modified3930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -182028,14 +182028,14 @@ stage: Modified - name: Modified3931 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key", "arch": "[x64]", "timestamp": 1606816958, "attributes": {"type": "registry_key", "mtime": 1606770045, "checksum": "8b83c264932a1f253ac9e60a3c7417b19337dfe7"}}' stage: Modified - name: Modified3932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -182045,14 +182045,14 @@ stage: Modified - name: Modified3933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key", "arch": "[x64]", "timestamp": 1606816958, "attributes": {"type": "registry_key", "mtime": 1606770045, "checksum": "8b83c264932a1f253ac9e60a3c7417b19337dfe7"}}' stage: Modified - name: Modified3934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182061,14 +182061,14 @@ stage: Modified - name: Modified3935 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","mtime":1606770045,"checksum":"8b83c264932a1f253ac9e60a3c7417b19337dfe7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key", "arch": "[x64]", "timestamp": 1606816958, "attributes": {"type": "registry_key", "mtime": 1606770045, "checksum": "8b83c264932a1f253ac9e60a3c7417b19337dfe7"}}' stage: Modified - name: Modified3936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182077,7 +182077,7 @@ stage: Modified - name: Modified3937 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3192\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3192\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -182087,7 +182087,7 @@ stage: Modified - name: Modified3938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3193\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3193\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -182097,7 +182097,7 @@ stage: Modified - name: Modified3939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3194\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3194\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182106,7 +182106,7 @@ stage: Modified - name: Modified3940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3195\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3195\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182115,7 +182115,7 @@ stage: Modified - name: Modified3941 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3196\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3196\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -182125,7 +182125,7 @@ stage: Modified - name: Modified3942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3197\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3197\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -182135,7 +182135,7 @@ stage: Modified - name: Modified3943 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3198\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3198\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182144,7 +182144,7 @@ stage: Modified - name: Modified3944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3199\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["size","md5","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3199\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182153,7 +182153,7 @@ stage: Modified - name: Modified3945 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182176,7 +182176,7 @@ stage: Modified - name: Modified3946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -182186,7 +182186,7 @@ stage: Modified - name: Modified3947 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182209,7 +182209,7 @@ stage: Modified - name: Modified3948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -182219,7 +182219,7 @@ stage: Modified - name: Modified3949 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182242,7 +182242,7 @@ stage: Modified - name: Modified3950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182251,7 +182251,7 @@ stage: Modified - name: Modified3951 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182274,7 +182274,7 @@ stage: Modified - name: Modified3952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182283,7 +182283,7 @@ stage: Modified - name: Modified3953 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182306,7 +182306,7 @@ stage: Modified - name: Modified3954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -182316,7 +182316,7 @@ stage: Modified - name: Modified3955 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816958,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182339,7 +182339,7 @@ stage: Modified - name: Modified3956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816958,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816958, "attributes": @@ -182349,7 +182349,7 @@ stage: Modified - name: Modified3957 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182372,7 +182372,7 @@ stage: Modified - name: Modified3958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -182381,7 +182381,7 @@ stage: Modified - name: Modified3959 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182404,7 +182404,7 @@ stage: Modified - name: Modified3960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -182413,7 +182413,7 @@ stage: Modified - name: Modified3961 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3208\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182436,7 +182436,7 @@ stage: Modified - name: Modified3962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3208\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3208\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182446,7 +182446,7 @@ stage: Modified - name: Modified3963 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3209\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182469,7 +182469,7 @@ stage: Modified - name: Modified3964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3209\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3209\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182479,7 +182479,7 @@ stage: Modified - name: Modified3965 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3210\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182502,7 +182502,7 @@ stage: Modified - name: Modified3966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3210\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3210\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182511,7 +182511,7 @@ stage: Modified - name: Modified3967 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3211\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182534,7 +182534,7 @@ stage: Modified - name: Modified3968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3211\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3211\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182543,7 +182543,7 @@ stage: Modified - name: Modified3969 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3212\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182566,7 +182566,7 @@ stage: Modified - name: Modified3970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3212\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3212\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182576,7 +182576,7 @@ stage: Modified - name: Modified3971 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3213\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182599,7 +182599,7 @@ stage: Modified - name: Modified3972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3213\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3213\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182609,7 +182609,7 @@ stage: Modified - name: Modified3973 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3214\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182632,7 +182632,7 @@ stage: Modified - name: Modified3974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3214\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3214\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -182641,7 +182641,7 @@ stage: Modified - name: Modified3975 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3215\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182664,7 +182664,7 @@ stage: Modified - name: Modified3976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3215\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3215\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -182673,7 +182673,7 @@ stage: Modified - name: Modified3977 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182682,7 +182682,7 @@ stage: Modified - name: Modified3978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182692,7 +182692,7 @@ stage: Modified - name: Modified3979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182701,7 +182701,7 @@ stage: Modified - name: Modified3980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182711,7 +182711,7 @@ stage: Modified - name: Modified3981 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182720,7 +182720,7 @@ stage: Modified - name: Modified3982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182729,7 +182729,7 @@ stage: Modified - name: Modified3983 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182738,7 +182738,7 @@ stage: Modified - name: Modified3984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182747,7 +182747,7 @@ stage: Modified - name: Modified3985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182756,7 +182756,7 @@ stage: Modified - name: Modified3986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182766,7 +182766,7 @@ stage: Modified - name: Modified3987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182775,7 +182775,7 @@ stage: Modified - name: Modified3988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182785,7 +182785,7 @@ stage: Modified - name: Modified3989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182794,7 +182794,7 @@ stage: Modified - name: Modified3990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -182803,7 +182803,7 @@ stage: Modified - name: Modified3991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770046,"checksum":"c69a2261d038436d1159c3cf8691562adba3e9c0"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182812,7 +182812,7 @@ stage: Modified - name: Modified3992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -182821,7 +182821,7 @@ stage: Modified - name: Modified3993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182830,7 +182830,7 @@ stage: Modified - name: Modified3994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3224\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182840,7 +182840,7 @@ stage: Modified - name: Modified3995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182849,7 +182849,7 @@ stage: Modified - name: Modified3996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3225\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182859,7 +182859,7 @@ stage: Modified - name: Modified3997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182868,7 +182868,7 @@ stage: Modified - name: Modified3998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3226\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182877,7 +182877,7 @@ stage: Modified - name: Modified3999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182886,7 +182886,7 @@ stage: Modified - name: Modified4000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3227\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -182895,7 +182895,7 @@ stage: Modified - name: Modified4001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182904,7 +182904,7 @@ stage: Modified - name: Modified4002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3228\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182914,7 +182914,7 @@ stage: Modified - name: Modified4003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182923,7 +182923,7 @@ stage: Modified - name: Modified4004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3229\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -182933,7 +182933,7 @@ stage: Modified - name: Modified4005 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182942,7 +182942,7 @@ stage: Modified - name: Modified4006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3230\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -182951,7 +182951,7 @@ stage: Modified - name: Modified4007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key", "arch": "[x64]", "timestamp": 1606816959, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -182960,7 +182960,7 @@ stage: Modified - name: Modified4008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3231\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -182969,7 +182969,7 @@ stage: Modified - name: Modified4009 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -182991,7 +182991,7 @@ stage: Modified - name: Modified4010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -183001,7 +183001,7 @@ stage: Modified - name: Modified4011 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183023,7 +183023,7 @@ stage: Modified - name: Modified4012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -183033,7 +183033,7 @@ stage: Modified - name: Modified4013 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183055,7 +183055,7 @@ stage: Modified - name: Modified4014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -183064,7 +183064,7 @@ stage: Modified - name: Modified4015 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183086,7 +183086,7 @@ stage: Modified - name: Modified4016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -183095,7 +183095,7 @@ stage: Modified - name: Modified4017 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183117,7 +183117,7 @@ stage: Modified - name: Modified4018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -183127,7 +183127,7 @@ stage: Modified - name: Modified4019 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183149,7 +183149,7 @@ stage: Modified - name: Modified4020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -183159,7 +183159,7 @@ stage: Modified - name: Modified4021 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183181,7 +183181,7 @@ stage: Modified - name: Modified4022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -183190,7 +183190,7 @@ stage: Modified - name: Modified4023 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183212,7 +183212,7 @@ stage: Modified - name: Modified4024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -183221,7 +183221,7 @@ stage: Modified - name: Modified4025 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3240\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183243,7 +183243,7 @@ stage: Modified - name: Modified4026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3240\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3240\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -183253,7 +183253,7 @@ stage: Modified - name: Modified4027 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3241\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183275,7 +183275,7 @@ stage: Modified - name: Modified4028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3241\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3241\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -183285,7 +183285,7 @@ stage: Modified - name: Modified4029 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3242\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183307,7 +183307,7 @@ stage: Modified - name: Modified4030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3242\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3242\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -183316,7 +183316,7 @@ stage: Modified - name: Modified4031 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3243\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183338,7 +183338,7 @@ stage: Modified - name: Modified4032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3243\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3243\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -183347,7 +183347,7 @@ stage: Modified - name: Modified4033 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3244\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816959,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183369,7 +183369,7 @@ stage: Modified - name: Modified4034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3244\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816959,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3244\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816959, "attributes": @@ -183379,7 +183379,7 @@ stage: Modified - name: Modified4035 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3245\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183401,7 +183401,7 @@ stage: Modified - name: Modified4036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3245\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3245\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183411,7 +183411,7 @@ stage: Modified - name: Modified4037 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3246\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183433,7 +183433,7 @@ stage: Modified - name: Modified4038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3246\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3246\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -183442,7 +183442,7 @@ stage: Modified - name: Modified4039 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3247\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183464,7 +183464,7 @@ stage: Modified - name: Modified4040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3247\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3247\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -183473,7 +183473,7 @@ stage: Modified - name: Modified4041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770046,"checksum":"d9c25fbbe832a024026df64c09c3cf902a44dcb5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770046,"checksum":"d9c25fbbe832a024026df64c09c3cf902a44dcb5"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183481,7 +183481,7 @@ stage: Modified - name: Modified4042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183491,7 +183491,7 @@ stage: Modified - name: Modified4043 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183499,7 +183499,7 @@ stage: Modified - name: Modified4044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183509,7 +183509,7 @@ stage: Modified - name: Modified4045 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183517,7 +183517,7 @@ stage: Modified - name: Modified4046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -183526,7 +183526,7 @@ stage: Modified - name: Modified4047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183534,7 +183534,7 @@ stage: Modified - name: Modified4048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -183543,7 +183543,7 @@ stage: Modified - name: Modified4049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183551,7 +183551,7 @@ stage: Modified - name: Modified4050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183561,7 +183561,7 @@ stage: Modified - name: Modified4051 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183569,7 +183569,7 @@ stage: Modified - name: Modified4052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183579,7 +183579,7 @@ stage: Modified - name: Modified4053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183587,7 +183587,7 @@ stage: Modified - name: Modified4054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -183596,7 +183596,7 @@ stage: Modified - name: Modified4055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770047,"checksum":"b7af6d47fb208961d34c61ff3249ed39677ff64c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183604,7 +183604,7 @@ stage: Modified - name: Modified4056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -183613,7 +183613,7 @@ stage: Modified - name: Modified4057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183621,7 +183621,7 @@ stage: Modified - name: Modified4058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3256\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183631,7 +183631,7 @@ stage: Modified - name: Modified4059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183639,7 +183639,7 @@ stage: Modified - name: Modified4060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3257\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183649,7 +183649,7 @@ stage: Modified - name: Modified4061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183657,7 +183657,7 @@ stage: Modified - name: Modified4062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3258\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -183666,7 +183666,7 @@ stage: Modified - name: Modified4063 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183674,7 +183674,7 @@ stage: Modified - name: Modified4064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3259\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -183683,7 +183683,7 @@ stage: Modified - name: Modified4065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183691,7 +183691,7 @@ stage: Modified - name: Modified4066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3260\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183701,7 +183701,7 @@ stage: Modified - name: Modified4067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183709,7 +183709,7 @@ stage: Modified - name: Modified4068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3261\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183719,7 +183719,7 @@ stage: Modified - name: Modified4069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183727,7 +183727,7 @@ stage: Modified - name: Modified4070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3262\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -183736,7 +183736,7 @@ stage: Modified - name: Modified4071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -183744,7 +183744,7 @@ stage: Modified - name: Modified4072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3263\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -183753,7 +183753,7 @@ stage: Modified - name: Modified4073 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183775,7 +183775,7 @@ stage: Modified - name: Modified4074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183785,7 +183785,7 @@ stage: Modified - name: Modified4075 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183807,7 +183807,7 @@ stage: Modified - name: Modified4076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183817,7 +183817,7 @@ stage: Modified - name: Modified4077 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183839,7 +183839,7 @@ stage: Modified - name: Modified4078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -183848,7 +183848,7 @@ stage: Modified - name: Modified4079 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183870,7 +183870,7 @@ stage: Modified - name: Modified4080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -183879,7 +183879,7 @@ stage: Modified - name: Modified4081 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183901,7 +183901,7 @@ stage: Modified - name: Modified4082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183911,7 +183911,7 @@ stage: Modified - name: Modified4083 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183933,7 +183933,7 @@ stage: Modified - name: Modified4084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -183943,7 +183943,7 @@ stage: Modified - name: Modified4085 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183965,7 +183965,7 @@ stage: Modified - name: Modified4086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -183974,7 +183974,7 @@ stage: Modified - name: Modified4087 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -183996,7 +183996,7 @@ stage: Modified - name: Modified4088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -184005,7 +184005,7 @@ stage: Modified - name: Modified4089 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3272\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184027,7 +184027,7 @@ stage: Modified - name: Modified4090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3272\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3272\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3272\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -184037,7 +184037,7 @@ stage: Modified - name: Modified4091 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3273\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184059,7 +184059,7 @@ stage: Modified - name: Modified4092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3273\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3273\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3273\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -184069,7 +184069,7 @@ stage: Modified - name: Modified4093 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3274\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184091,7 +184091,7 @@ stage: Modified - name: Modified4094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3274\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3274\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3274\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -184100,7 +184100,7 @@ stage: Modified - name: Modified4095 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3275\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184122,7 +184122,7 @@ stage: Modified - name: Modified4096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3275\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3275\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3275\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -184131,7 +184131,7 @@ stage: Modified - name: Modified4097 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3276\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184153,7 +184153,7 @@ stage: Modified - name: Modified4098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3276\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3276\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3276\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -184163,7 +184163,7 @@ stage: Modified - name: Modified4099 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3277\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184185,7 +184185,7 @@ stage: Modified - name: Modified4100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3277\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3277\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3277\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -184195,7 +184195,7 @@ stage: Modified - name: Modified4101 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3278\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184217,7 +184217,7 @@ stage: Modified - name: Modified4102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3278\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3278\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3278\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -184226,7 +184226,7 @@ stage: Modified - name: Modified4103 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3279\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184248,7 +184248,7 @@ stage: Modified - name: Modified4104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3279\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3279\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3279\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -184257,7 +184257,7 @@ stage: Modified - name: Modified4105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -184265,7 +184265,7 @@ stage: Modified - name: Modified4106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -184275,7 +184275,7 @@ stage: Modified - name: Modified4107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816960,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key", "arch": "[x64]", "timestamp": 1606816960, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -184283,7 +184283,7 @@ stage: Modified - name: Modified4108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816960,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816960, "attributes": @@ -184293,7 +184293,7 @@ stage: Modified - name: Modified4109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -184301,7 +184301,7 @@ stage: Modified - name: Modified4110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -184310,7 +184310,7 @@ stage: Modified - name: Modified4111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -184318,7 +184318,7 @@ stage: Modified - name: Modified4112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -184327,7 +184327,7 @@ stage: Modified - name: Modified4113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -184335,7 +184335,7 @@ stage: Modified - name: Modified4114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184345,7 +184345,7 @@ stage: Modified - name: Modified4115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -184353,7 +184353,7 @@ stage: Modified - name: Modified4116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184363,7 +184363,7 @@ stage: Modified - name: Modified4117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -184371,7 +184371,7 @@ stage: Modified - name: Modified4118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -184380,7 +184380,7 @@ stage: Modified - name: Modified4119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770047,"checksum":"7b6a6422c506dce82968c60680371f42761c2583"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -184388,7 +184388,7 @@ stage: Modified - name: Modified4120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -184397,7 +184397,7 @@ stage: Modified - name: Modified4121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3288\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3288\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3288\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184407,7 +184407,7 @@ stage: Modified - name: Modified4122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3289\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3289\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3289\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184417,7 +184417,7 @@ stage: Modified - name: Modified4123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3290\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3290\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3290\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -184426,7 +184426,7 @@ stage: Modified - name: Modified4124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3291\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3291\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3291\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -184435,7 +184435,7 @@ stage: Modified - name: Modified4125 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3292\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3292\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3292\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184445,7 +184445,7 @@ stage: Modified - name: Modified4126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3293\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3293\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3293\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184455,7 +184455,7 @@ stage: Modified - name: Modified4127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3294\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3294\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3294\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -184464,7 +184464,7 @@ stage: Modified - name: Modified4128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3295\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3295\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3295\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -184473,7 +184473,7 @@ stage: Modified - name: Modified4129 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184494,7 +184494,7 @@ stage: Modified - name: Modified4130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184504,7 +184504,7 @@ stage: Modified - name: Modified4131 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184525,7 +184525,7 @@ stage: Modified - name: Modified4132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184535,7 +184535,7 @@ stage: Modified - name: Modified4133 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184556,7 +184556,7 @@ stage: Modified - name: Modified4134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -184565,7 +184565,7 @@ stage: Modified - name: Modified4135 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184586,7 +184586,7 @@ stage: Modified - name: Modified4136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -184595,7 +184595,7 @@ stage: Modified - name: Modified4137 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184616,7 +184616,7 @@ stage: Modified - name: Modified4138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184626,7 +184626,7 @@ stage: Modified - name: Modified4139 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184647,7 +184647,7 @@ stage: Modified - name: Modified4140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184657,7 +184657,7 @@ stage: Modified - name: Modified4141 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184678,7 +184678,7 @@ stage: Modified - name: Modified4142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -184687,7 +184687,7 @@ stage: Modified - name: Modified4143 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184708,7 +184708,7 @@ stage: Modified - name: Modified4144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -184717,7 +184717,7 @@ stage: Modified - name: Modified4145 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3304\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184738,7 +184738,7 @@ stage: Modified - name: Modified4146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3304\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3304\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3304\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184748,7 +184748,7 @@ stage: Modified - name: Modified4147 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3305\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184769,7 +184769,7 @@ stage: Modified - name: Modified4148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3305\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3305\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3305\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184779,7 +184779,7 @@ stage: Modified - name: Modified4149 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3306\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184800,7 +184800,7 @@ stage: Modified - name: Modified4150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3306\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3306\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3306\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -184809,7 +184809,7 @@ stage: Modified - name: Modified4151 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3307\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184830,7 +184830,7 @@ stage: Modified - name: Modified4152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3307\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3307\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3307\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -184839,7 +184839,7 @@ stage: Modified - name: Modified4153 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3308\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184860,7 +184860,7 @@ stage: Modified - name: Modified4154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3308\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3308\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3308\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184870,7 +184870,7 @@ stage: Modified - name: Modified4155 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3309\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184891,7 +184891,7 @@ stage: Modified - name: Modified4156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3309\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3309\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3309\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184901,7 +184901,7 @@ stage: Modified - name: Modified4157 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3310\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184922,7 +184922,7 @@ stage: Modified - name: Modified4158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3310\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3310\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3310\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -184931,7 +184931,7 @@ stage: Modified - name: Modified4159 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3311\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -184952,7 +184952,7 @@ stage: Modified - name: Modified4160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3311\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3311\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3311\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -184961,14 +184961,14 @@ stage: Modified - name: Modified4161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "mtime": 1606770048, "checksum": "399aa98ee756785fd89ac491cf3fc41cf3ce40f5"}}' stage: Modified - name: Modified4162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184978,14 +184978,14 @@ stage: Modified - name: Modified4163 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "mtime": 1606770048, "checksum": "399aa98ee756785fd89ac491cf3fc41cf3ce40f5"}}' stage: Modified - name: Modified4164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -184995,14 +184995,14 @@ stage: Modified - name: Modified4165 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "mtime": 1606770048, "checksum": "399aa98ee756785fd89ac491cf3fc41cf3ce40f5"}}' stage: Modified - name: Modified4166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185011,14 +185011,14 @@ stage: Modified - name: Modified4167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "mtime": 1606770048, "checksum": "399aa98ee756785fd89ac491cf3fc41cf3ce40f5"}}' stage: Modified - name: Modified4168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185027,14 +185027,14 @@ stage: Modified - name: Modified4169 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "mtime": 1606770048, "checksum": "399aa98ee756785fd89ac491cf3fc41cf3ce40f5"}}' stage: Modified - name: Modified4170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -185044,14 +185044,14 @@ stage: Modified - name: Modified4171 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "mtime": 1606770048, "checksum": "399aa98ee756785fd89ac491cf3fc41cf3ce40f5"}}' stage: Modified - name: Modified4172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -185061,14 +185061,14 @@ stage: Modified - name: Modified4173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "mtime": 1606770048, "checksum": "399aa98ee756785fd89ac491cf3fc41cf3ce40f5"}}' stage: Modified - name: Modified4174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -185077,14 +185077,14 @@ stage: Modified - name: Modified4175 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816961,"attributes":{"type":"registry_key","mtime":1606770048,"checksum":"399aa98ee756785fd89ac491cf3fc41cf3ce40f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key", "arch": "[x64]", "timestamp": 1606816961, "attributes": {"type": "registry_key", "mtime": 1606770048, "checksum": "399aa98ee756785fd89ac491cf3fc41cf3ce40f5"}}' stage: Modified - name: Modified4176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -185093,7 +185093,7 @@ stage: Modified - name: Modified4177 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3320\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3320\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3320\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -185103,7 +185103,7 @@ stage: Modified - name: Modified4178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3321\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3321\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3321\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -185113,7 +185113,7 @@ stage: Modified - name: Modified4179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3322\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3322\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3322\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185122,7 +185122,7 @@ stage: Modified - name: Modified4180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3323\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3323\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3323\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185131,7 +185131,7 @@ stage: Modified - name: Modified4181 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3324\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3324\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816961,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3324\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816961, "attributes": @@ -185141,7 +185141,7 @@ stage: Modified - name: Modified4182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3325\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3325\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3325\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185151,7 +185151,7 @@ stage: Modified - name: Modified4183 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3326\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3326\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3326\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -185160,7 +185160,7 @@ stage: Modified - name: Modified4184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3327\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3327\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"2175d33d1893c31329a25f7b261df392be8f53d8"},"changed_attributes":["md5","sha256"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"99b8c755468f1e80c6993d8b92327ba1e3e76fdc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3327\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "hash_sha256": @@ -185169,7 +185169,7 @@ stage: Modified - name: Modified4185 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185192,7 +185192,7 @@ stage: Modified - name: Modified4186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185201,7 +185201,7 @@ stage: Modified - name: Modified4187 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185224,7 +185224,7 @@ stage: Modified - name: Modified4188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185233,7 +185233,7 @@ stage: Modified - name: Modified4189 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185256,7 +185256,7 @@ stage: Modified - name: Modified4190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185264,7 +185264,7 @@ stage: Modified - name: Modified4191 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185287,7 +185287,7 @@ stage: Modified - name: Modified4192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185295,7 +185295,7 @@ stage: Modified - name: Modified4193 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185318,7 +185318,7 @@ stage: Modified - name: Modified4194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185327,7 +185327,7 @@ stage: Modified - name: Modified4195 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185350,7 +185350,7 @@ stage: Modified - name: Modified4196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185359,7 +185359,7 @@ stage: Modified - name: Modified4197 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185382,7 +185382,7 @@ stage: Modified - name: Modified4198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185390,7 +185390,7 @@ stage: Modified - name: Modified4199 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185413,7 +185413,7 @@ stage: Modified - name: Modified4200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185421,7 +185421,7 @@ stage: Modified - name: Modified4201 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3336\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185444,7 +185444,7 @@ stage: Modified - name: Modified4202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3336\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3336\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3336\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185453,7 +185453,7 @@ stage: Modified - name: Modified4203 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3337\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185476,7 +185476,7 @@ stage: Modified - name: Modified4204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3337\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3337\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3337\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185485,7 +185485,7 @@ stage: Modified - name: Modified4205 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3338\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185508,7 +185508,7 @@ stage: Modified - name: Modified4206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3338\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3338\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3338\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185516,7 +185516,7 @@ stage: Modified - name: Modified4207 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3339\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185539,7 +185539,7 @@ stage: Modified - name: Modified4208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3339\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3339\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3339\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185547,7 +185547,7 @@ stage: Modified - name: Modified4209 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3340\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185570,7 +185570,7 @@ stage: Modified - name: Modified4210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3340\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3340\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3340\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185579,7 +185579,7 @@ stage: Modified - name: Modified4211 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3341\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185602,7 +185602,7 @@ stage: Modified - name: Modified4212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3341\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3341\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3341\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185611,7 +185611,7 @@ stage: Modified - name: Modified4213 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3342\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185634,7 +185634,7 @@ stage: Modified - name: Modified4214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3342\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3342\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3342\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185642,7 +185642,7 @@ stage: Modified - name: Modified4215 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3343\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185665,7 +185665,7 @@ stage: Modified - name: Modified4216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3343\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3343\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3343\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185673,7 +185673,7 @@ stage: Modified - name: Modified4217 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185682,7 +185682,7 @@ stage: Modified - name: Modified4218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185691,7 +185691,7 @@ stage: Modified - name: Modified4219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185700,7 +185700,7 @@ stage: Modified - name: Modified4220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185709,7 +185709,7 @@ stage: Modified - name: Modified4221 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185718,7 +185718,7 @@ stage: Modified - name: Modified4222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185726,7 +185726,7 @@ stage: Modified - name: Modified4223 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185735,7 +185735,7 @@ stage: Modified - name: Modified4224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185743,7 +185743,7 @@ stage: Modified - name: Modified4225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185752,7 +185752,7 @@ stage: Modified - name: Modified4226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185761,7 +185761,7 @@ stage: Modified - name: Modified4227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185770,7 +185770,7 @@ stage: Modified - name: Modified4228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185779,7 +185779,7 @@ stage: Modified - name: Modified4229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185788,7 +185788,7 @@ stage: Modified - name: Modified4230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185796,7 +185796,7 @@ stage: Modified - name: Modified4231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770048,"checksum":"f2b8966dd9449e9866a0823cfb0d34aa69b91d21"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185805,7 +185805,7 @@ stage: Modified - name: Modified4232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185813,7 +185813,7 @@ stage: Modified - name: Modified4233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185822,7 +185822,7 @@ stage: Modified - name: Modified4234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3352\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185831,7 +185831,7 @@ stage: Modified - name: Modified4235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185840,7 +185840,7 @@ stage: Modified - name: Modified4236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3353\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185849,7 +185849,7 @@ stage: Modified - name: Modified4237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185858,7 +185858,7 @@ stage: Modified - name: Modified4238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3354\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185866,7 +185866,7 @@ stage: Modified - name: Modified4239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185875,7 +185875,7 @@ stage: Modified - name: Modified4240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3355\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185883,7 +185883,7 @@ stage: Modified - name: Modified4241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185892,7 +185892,7 @@ stage: Modified - name: Modified4242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3356\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185901,7 +185901,7 @@ stage: Modified - name: Modified4243 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185910,7 +185910,7 @@ stage: Modified - name: Modified4244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3357\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185919,7 +185919,7 @@ stage: Modified - name: Modified4245 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185928,7 +185928,7 @@ stage: Modified - name: Modified4246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3358\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185936,7 +185936,7 @@ stage: Modified - name: Modified4247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key", "arch": "[x64]", "timestamp": 1606816962, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -185945,7 +185945,7 @@ stage: Modified - name: Modified4248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3359\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -185953,7 +185953,7 @@ stage: Modified - name: Modified4249 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816962,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -185975,7 +185975,7 @@ stage: Modified - name: Modified4250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816962,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816962, "attributes": @@ -185984,7 +185984,7 @@ stage: Modified - name: Modified4251 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186006,7 +186006,7 @@ stage: Modified - name: Modified4252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186015,7 +186015,7 @@ stage: Modified - name: Modified4253 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186037,7 +186037,7 @@ stage: Modified - name: Modified4254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186045,7 +186045,7 @@ stage: Modified - name: Modified4255 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186067,7 +186067,7 @@ stage: Modified - name: Modified4256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186075,7 +186075,7 @@ stage: Modified - name: Modified4257 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186097,7 +186097,7 @@ stage: Modified - name: Modified4258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186106,7 +186106,7 @@ stage: Modified - name: Modified4259 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186128,7 +186128,7 @@ stage: Modified - name: Modified4260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186137,7 +186137,7 @@ stage: Modified - name: Modified4261 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186159,7 +186159,7 @@ stage: Modified - name: Modified4262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186167,7 +186167,7 @@ stage: Modified - name: Modified4263 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186189,7 +186189,7 @@ stage: Modified - name: Modified4264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186197,7 +186197,7 @@ stage: Modified - name: Modified4265 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3368\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186219,7 +186219,7 @@ stage: Modified - name: Modified4266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3368\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3368\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3368\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186228,7 +186228,7 @@ stage: Modified - name: Modified4267 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3369\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186250,7 +186250,7 @@ stage: Modified - name: Modified4268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3369\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3369\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3369\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186259,7 +186259,7 @@ stage: Modified - name: Modified4269 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3370\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186281,7 +186281,7 @@ stage: Modified - name: Modified4270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3370\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3370\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3370\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186289,7 +186289,7 @@ stage: Modified - name: Modified4271 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3371\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186311,7 +186311,7 @@ stage: Modified - name: Modified4272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3371\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3371\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3371\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186319,7 +186319,7 @@ stage: Modified - name: Modified4273 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3372\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186341,7 +186341,7 @@ stage: Modified - name: Modified4274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3372\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3372\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3372\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186350,7 +186350,7 @@ stage: Modified - name: Modified4275 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3373\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186372,7 +186372,7 @@ stage: Modified - name: Modified4276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3373\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3373\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3373\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186381,7 +186381,7 @@ stage: Modified - name: Modified4277 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3374\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186403,7 +186403,7 @@ stage: Modified - name: Modified4278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3374\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3374\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3374\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186411,7 +186411,7 @@ stage: Modified - name: Modified4279 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3375\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186433,7 +186433,7 @@ stage: Modified - name: Modified4280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3375\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3375\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3375\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186441,7 +186441,7 @@ stage: Modified - name: Modified4281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186449,7 +186449,7 @@ stage: Modified - name: Modified4282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186458,7 +186458,7 @@ stage: Modified - name: Modified4283 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186466,7 +186466,7 @@ stage: Modified - name: Modified4284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186475,7 +186475,7 @@ stage: Modified - name: Modified4285 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186483,7 +186483,7 @@ stage: Modified - name: Modified4286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186491,7 +186491,7 @@ stage: Modified - name: Modified4287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186499,7 +186499,7 @@ stage: Modified - name: Modified4288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186507,7 +186507,7 @@ stage: Modified - name: Modified4289 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186515,7 +186515,7 @@ stage: Modified - name: Modified4290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186524,7 +186524,7 @@ stage: Modified - name: Modified4291 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186532,7 +186532,7 @@ stage: Modified - name: Modified4292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186541,7 +186541,7 @@ stage: Modified - name: Modified4293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186549,7 +186549,7 @@ stage: Modified - name: Modified4294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186557,7 +186557,7 @@ stage: Modified - name: Modified4295 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770049,"checksum":"2706f7aa338234df82d6efa5b56ef3b596b09d4c"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186565,7 +186565,7 @@ stage: Modified - name: Modified4296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186573,7 +186573,7 @@ stage: Modified - name: Modified4297 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186581,7 +186581,7 @@ stage: Modified - name: Modified4298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3384\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186590,7 +186590,7 @@ stage: Modified - name: Modified4299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186598,7 +186598,7 @@ stage: Modified - name: Modified4300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3385\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186607,7 +186607,7 @@ stage: Modified - name: Modified4301 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186615,7 +186615,7 @@ stage: Modified - name: Modified4302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3386\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186623,7 +186623,7 @@ stage: Modified - name: Modified4303 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186631,7 +186631,7 @@ stage: Modified - name: Modified4304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3387\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186639,7 +186639,7 @@ stage: Modified - name: Modified4305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186647,7 +186647,7 @@ stage: Modified - name: Modified4306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3388\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186656,7 +186656,7 @@ stage: Modified - name: Modified4307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186664,7 +186664,7 @@ stage: Modified - name: Modified4308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3389\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186673,7 +186673,7 @@ stage: Modified - name: Modified4309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186681,7 +186681,7 @@ stage: Modified - name: Modified4310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3390\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186689,7 +186689,7 @@ stage: Modified - name: Modified4311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key", "arch": "[x64]", "timestamp": 1606816963, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -186697,7 +186697,7 @@ stage: Modified - name: Modified4312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3391\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186705,7 +186705,7 @@ stage: Modified - name: Modified4313 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186727,7 +186727,7 @@ stage: Modified - name: Modified4314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186736,7 +186736,7 @@ stage: Modified - name: Modified4315 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186758,7 +186758,7 @@ stage: Modified - name: Modified4316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186767,7 +186767,7 @@ stage: Modified - name: Modified4317 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186789,7 +186789,7 @@ stage: Modified - name: Modified4318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186797,7 +186797,7 @@ stage: Modified - name: Modified4319 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186819,7 +186819,7 @@ stage: Modified - name: Modified4320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186827,7 +186827,7 @@ stage: Modified - name: Modified4321 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186849,7 +186849,7 @@ stage: Modified - name: Modified4322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186858,7 +186858,7 @@ stage: Modified - name: Modified4323 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816963,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186880,7 +186880,7 @@ stage: Modified - name: Modified4324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816963,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816963, "attributes": @@ -186889,7 +186889,7 @@ stage: Modified - name: Modified4325 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186911,7 +186911,7 @@ stage: Modified - name: Modified4326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186919,7 +186919,7 @@ stage: Modified - name: Modified4327 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186941,7 +186941,7 @@ stage: Modified - name: Modified4328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -186949,7 +186949,7 @@ stage: Modified - name: Modified4329 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3400\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -186971,7 +186971,7 @@ stage: Modified - name: Modified4330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3400\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3400\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3400\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -186980,7 +186980,7 @@ stage: Modified - name: Modified4331 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3401\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187002,7 +187002,7 @@ stage: Modified - name: Modified4332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3401\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3401\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3401\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187011,7 +187011,7 @@ stage: Modified - name: Modified4333 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3402\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187033,7 +187033,7 @@ stage: Modified - name: Modified4334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3402\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3402\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3402\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187041,7 +187041,7 @@ stage: Modified - name: Modified4335 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3403\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187063,7 +187063,7 @@ stage: Modified - name: Modified4336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3403\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3403\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3403\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187071,7 +187071,7 @@ stage: Modified - name: Modified4337 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3404\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187093,7 +187093,7 @@ stage: Modified - name: Modified4338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3404\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3404\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3404\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187102,7 +187102,7 @@ stage: Modified - name: Modified4339 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3405\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187124,7 +187124,7 @@ stage: Modified - name: Modified4340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3405\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3405\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3405\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187133,7 +187133,7 @@ stage: Modified - name: Modified4341 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3406\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187155,7 +187155,7 @@ stage: Modified - name: Modified4342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3406\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3406\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3406\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187163,7 +187163,7 @@ stage: Modified - name: Modified4343 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3407\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187185,7 +187185,7 @@ stage: Modified - name: Modified4344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3407\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3407\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3407\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187193,7 +187193,7 @@ stage: Modified - name: Modified4345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key", "arch": "[x64]", "timestamp": 1606816964, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -187201,7 +187201,7 @@ stage: Modified - name: Modified4346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187210,7 +187210,7 @@ stage: Modified - name: Modified4347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key", "arch": "[x64]", "timestamp": 1606816964, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -187218,7 +187218,7 @@ stage: Modified - name: Modified4348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187227,7 +187227,7 @@ stage: Modified - name: Modified4349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key", "arch": "[x64]", "timestamp": 1606816964, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -187235,7 +187235,7 @@ stage: Modified - name: Modified4350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187243,7 +187243,7 @@ stage: Modified - name: Modified4351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key", "arch": "[x64]", "timestamp": 1606816964, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -187251,7 +187251,7 @@ stage: Modified - name: Modified4352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187259,7 +187259,7 @@ stage: Modified - name: Modified4353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key", "arch": "[x64]", "timestamp": 1606816964, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -187267,7 +187267,7 @@ stage: Modified - name: Modified4354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187276,7 +187276,7 @@ stage: Modified - name: Modified4355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key", "arch": "[x64]", "timestamp": 1606816964, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -187284,7 +187284,7 @@ stage: Modified - name: Modified4356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187293,7 +187293,7 @@ stage: Modified - name: Modified4357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key", "arch": "[x64]", "timestamp": 1606816964, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -187301,7 +187301,7 @@ stage: Modified - name: Modified4358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187309,7 +187309,7 @@ stage: Modified - name: Modified4359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770049,"checksum":"a09bee5e0de6d2b865e3e4592b352a520b6d1207"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key", "arch": "[x64]", "timestamp": 1606816964, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -187317,7 +187317,7 @@ stage: Modified - name: Modified4360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187325,7 +187325,7 @@ stage: Modified - name: Modified4361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3416\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3416\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3416\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187334,7 +187334,7 @@ stage: Modified - name: Modified4362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3417\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3417\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3417\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187343,7 +187343,7 @@ stage: Modified - name: Modified4363 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3418\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3418\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3418\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187351,7 +187351,7 @@ stage: Modified - name: Modified4364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3419\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3419\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3419\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187359,7 +187359,7 @@ stage: Modified - name: Modified4365 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3420\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3420\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3420\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187368,7 +187368,7 @@ stage: Modified - name: Modified4366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3421\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3421\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3421\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187377,7 +187377,7 @@ stage: Modified - name: Modified4367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3422\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3422\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3422\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187385,7 +187385,7 @@ stage: Modified - name: Modified4368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3423\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3423\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3423\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187393,7 +187393,7 @@ stage: Modified - name: Modified4369 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187414,7 +187414,7 @@ stage: Modified - name: Modified4370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187423,7 +187423,7 @@ stage: Modified - name: Modified4371 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187444,7 +187444,7 @@ stage: Modified - name: Modified4372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187453,7 +187453,7 @@ stage: Modified - name: Modified4373 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187474,7 +187474,7 @@ stage: Modified - name: Modified4374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187482,7 +187482,7 @@ stage: Modified - name: Modified4375 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187503,7 +187503,7 @@ stage: Modified - name: Modified4376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187511,7 +187511,7 @@ stage: Modified - name: Modified4377 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187532,7 +187532,7 @@ stage: Modified - name: Modified4378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187541,7 +187541,7 @@ stage: Modified - name: Modified4379 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187562,7 +187562,7 @@ stage: Modified - name: Modified4380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187571,7 +187571,7 @@ stage: Modified - name: Modified4381 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187592,7 +187592,7 @@ stage: Modified - name: Modified4382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187600,7 +187600,7 @@ stage: Modified - name: Modified4383 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187621,7 +187621,7 @@ stage: Modified - name: Modified4384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187629,7 +187629,7 @@ stage: Modified - name: Modified4385 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3432\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187650,7 +187650,7 @@ stage: Modified - name: Modified4386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3432\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3432\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3432\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187659,7 +187659,7 @@ stage: Modified - name: Modified4387 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3433\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816964,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187680,7 +187680,7 @@ stage: Modified - name: Modified4388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3433\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3433\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816964,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3433\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816964, "attributes": @@ -187689,7 +187689,7 @@ stage: Modified - name: Modified4389 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3434\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187710,7 +187710,7 @@ stage: Modified - name: Modified4390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3434\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3434\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3434\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187718,7 +187718,7 @@ stage: Modified - name: Modified4391 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3435\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187739,7 +187739,7 @@ stage: Modified - name: Modified4392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3435\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3435\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3435\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187747,7 +187747,7 @@ stage: Modified - name: Modified4393 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3436\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187768,7 +187768,7 @@ stage: Modified - name: Modified4394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3436\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3436\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3436\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -187777,7 +187777,7 @@ stage: Modified - name: Modified4395 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3437\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187798,7 +187798,7 @@ stage: Modified - name: Modified4396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3437\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3437\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3437\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -187807,7 +187807,7 @@ stage: Modified - name: Modified4397 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3438\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187828,7 +187828,7 @@ stage: Modified - name: Modified4398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3438\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3438\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3438\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187836,7 +187836,7 @@ stage: Modified - name: Modified4399 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3439\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -187857,7 +187857,7 @@ stage: Modified - name: Modified4400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3439\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3439\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3439\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187865,14 +187865,14 @@ stage: Modified - name: Modified4401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key", "arch": "[x64]", "timestamp": 1606816965, "attributes": {"type": "registry_key", "mtime": 1606770050, "checksum": "e15e81ac7bf10714474c327f72a06731e04637f9"}}' stage: Modified - name: Modified4402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -187881,14 +187881,14 @@ stage: Modified - name: Modified4403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key", "arch": "[x64]", "timestamp": 1606816965, "attributes": {"type": "registry_key", "mtime": 1606770050, "checksum": "e15e81ac7bf10714474c327f72a06731e04637f9"}}' stage: Modified - name: Modified4404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -187897,14 +187897,14 @@ stage: Modified - name: Modified4405 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key", "arch": "[x64]", "timestamp": 1606816965, "attributes": {"type": "registry_key", "mtime": 1606770050, "checksum": "e15e81ac7bf10714474c327f72a06731e04637f9"}}' stage: Modified - name: Modified4406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187912,14 +187912,14 @@ stage: Modified - name: Modified4407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key", "arch": "[x64]", "timestamp": 1606816965, "attributes": {"type": "registry_key", "mtime": 1606770050, "checksum": "e15e81ac7bf10714474c327f72a06731e04637f9"}}' stage: Modified - name: Modified4408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187927,14 +187927,14 @@ stage: Modified - name: Modified4409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key", "arch": "[x64]", "timestamp": 1606816965, "attributes": {"type": "registry_key", "mtime": 1606770050, "checksum": "e15e81ac7bf10714474c327f72a06731e04637f9"}}' stage: Modified - name: Modified4410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -187943,14 +187943,14 @@ stage: Modified - name: Modified4411 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key", "arch": "[x64]", "timestamp": 1606816965, "attributes": {"type": "registry_key", "mtime": 1606770050, "checksum": "e15e81ac7bf10714474c327f72a06731e04637f9"}}' stage: Modified - name: Modified4412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -187959,14 +187959,14 @@ stage: Modified - name: Modified4413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key", "arch": "[x64]", "timestamp": 1606816965, "attributes": {"type": "registry_key", "mtime": 1606770050, "checksum": "e15e81ac7bf10714474c327f72a06731e04637f9"}}' stage: Modified - name: Modified4414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187974,14 +187974,14 @@ stage: Modified - name: Modified4415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","mtime":1606770050,"checksum":"e15e81ac7bf10714474c327f72a06731e04637f9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key", "arch": "[x64]", "timestamp": 1606816965, "attributes": {"type": "registry_key", "mtime": 1606770050, "checksum": "e15e81ac7bf10714474c327f72a06731e04637f9"}}' stage: Modified - name: Modified4416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -187989,7 +187989,7 @@ stage: Modified - name: Modified4417 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3448\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3448\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3448\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -187998,7 +187998,7 @@ stage: Modified - name: Modified4418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3449\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3449\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3449\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -188007,7 +188007,7 @@ stage: Modified - name: Modified4419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3450\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3450\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3450\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188015,7 +188015,7 @@ stage: Modified - name: Modified4420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3451\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3451\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3451\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188023,7 +188023,7 @@ stage: Modified - name: Modified4421 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3452\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3452\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3452\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -188032,7 +188032,7 @@ stage: Modified - name: Modified4422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3453\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3453\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3453\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -188041,7 +188041,7 @@ stage: Modified - name: Modified4423 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3454\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3454\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3454\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188049,7 +188049,7 @@ stage: Modified - name: Modified4424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3455\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3455\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["size","md5"],"old_attributes":{"type":"registry_value","size":6,"hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3455\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "size": 9, "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188057,7 +188057,7 @@ stage: Modified - name: Modified4425 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188080,7 +188080,7 @@ stage: Modified - name: Modified4426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -188089,7 +188089,7 @@ stage: Modified - name: Modified4427 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188112,7 +188112,7 @@ stage: Modified - name: Modified4428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -188121,7 +188121,7 @@ stage: Modified - name: Modified4429 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188144,7 +188144,7 @@ stage: Modified - name: Modified4430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188152,7 +188152,7 @@ stage: Modified - name: Modified4431 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188175,7 +188175,7 @@ stage: Modified - name: Modified4432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188183,7 +188183,7 @@ stage: Modified - name: Modified4433 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188206,7 +188206,7 @@ stage: Modified - name: Modified4434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -188215,7 +188215,7 @@ stage: Modified - name: Modified4435 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188238,7 +188238,7 @@ stage: Modified - name: Modified4436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -188247,7 +188247,7 @@ stage: Modified - name: Modified4437 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188270,7 +188270,7 @@ stage: Modified - name: Modified4438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -188278,7 +188278,7 @@ stage: Modified - name: Modified4439 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188301,7 +188301,7 @@ stage: Modified - name: Modified4440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -188309,7 +188309,7 @@ stage: Modified - name: Modified4441 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3464\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188332,7 +188332,7 @@ stage: Modified - name: Modified4442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3464\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3464\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3464\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -188341,7 +188341,7 @@ stage: Modified - name: Modified4443 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3465\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188364,7 +188364,7 @@ stage: Modified - name: Modified4444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3465\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3465\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3465\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -188373,7 +188373,7 @@ stage: Modified - name: Modified4445 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3466\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188396,7 +188396,7 @@ stage: Modified - name: Modified4446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3466\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3466\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3466\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188404,7 +188404,7 @@ stage: Modified - name: Modified4447 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3467\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188427,7 +188427,7 @@ stage: Modified - name: Modified4448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3467\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3467\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3467\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188435,7 +188435,7 @@ stage: Modified - name: Modified4449 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3468\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188458,7 +188458,7 @@ stage: Modified - name: Modified4450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3468\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3468\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3468\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -188467,7 +188467,7 @@ stage: Modified - name: Modified4451 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3469\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816965,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188490,7 +188490,7 @@ stage: Modified - name: Modified4452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3469\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3469\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816965,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3469\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816965, "attributes": @@ -188499,7 +188499,7 @@ stage: Modified - name: Modified4453 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3470\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188522,7 +188522,7 @@ stage: Modified - name: Modified4454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3470\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3470\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3470\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -188530,7 +188530,7 @@ stage: Modified - name: Modified4455 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3471\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188553,7 +188553,7 @@ stage: Modified - name: Modified4456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3471\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3471\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3471\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -188561,7 +188561,7 @@ stage: Modified - name: Modified4457 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770050,"checksum":"6ffb676cc77be4655236d11df2ea1dada38116d2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770050,"checksum":"6ffb676cc77be4655236d11df2ea1dada38116d2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188570,7 +188570,7 @@ stage: Modified - name: Modified4458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -188579,7 +188579,7 @@ stage: Modified - name: Modified4459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770050,"checksum":"6ffb676cc77be4655236d11df2ea1dada38116d2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770050,"checksum":"6ffb676cc77be4655236d11df2ea1dada38116d2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188588,7 +188588,7 @@ stage: Modified - name: Modified4460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -188597,7 +188597,7 @@ stage: Modified - name: Modified4461 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770050,"checksum":"6ffb676cc77be4655236d11df2ea1dada38116d2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770050,"checksum":"6ffb676cc77be4655236d11df2ea1dada38116d2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188606,7 +188606,7 @@ stage: Modified - name: Modified4462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188614,7 +188614,7 @@ stage: Modified - name: Modified4463 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770050,"checksum":"6ffb676cc77be4655236d11df2ea1dada38116d2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770050,"checksum":"6ffb676cc77be4655236d11df2ea1dada38116d2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188623,7 +188623,7 @@ stage: Modified - name: Modified4464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188631,7 +188631,7 @@ stage: Modified - name: Modified4465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770050,"checksum":"6ffb676cc77be4655236d11df2ea1dada38116d2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770050,"checksum":"6ffb676cc77be4655236d11df2ea1dada38116d2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188640,7 +188640,7 @@ stage: Modified - name: Modified4466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -188649,7 +188649,7 @@ stage: Modified - name: Modified4467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770051,"checksum":"7ff769b61913d8d929a0f4824f8293ef5617a638"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770051,"checksum":"7ff769b61913d8d929a0f4824f8293ef5617a638"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188658,7 +188658,7 @@ stage: Modified - name: Modified4468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -188667,7 +188667,7 @@ stage: Modified - name: Modified4469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770051,"checksum":"7ff769b61913d8d929a0f4824f8293ef5617a638"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770051,"checksum":"7ff769b61913d8d929a0f4824f8293ef5617a638"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188676,7 +188676,7 @@ stage: Modified - name: Modified4470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -188684,7 +188684,7 @@ stage: Modified - name: Modified4471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770051,"checksum":"7ff769b61913d8d929a0f4824f8293ef5617a638"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770051,"checksum":"7ff769b61913d8d929a0f4824f8293ef5617a638"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188693,7 +188693,7 @@ stage: Modified - name: Modified4472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -188701,7 +188701,7 @@ stage: Modified - name: Modified4473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188710,7 +188710,7 @@ stage: Modified - name: Modified4474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3480\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -188719,7 +188719,7 @@ stage: Modified - name: Modified4475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188728,7 +188728,7 @@ stage: Modified - name: Modified4476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3481\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -188737,7 +188737,7 @@ stage: Modified - name: Modified4477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188746,7 +188746,7 @@ stage: Modified - name: Modified4478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3482\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188754,7 +188754,7 @@ stage: Modified - name: Modified4479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188763,7 +188763,7 @@ stage: Modified - name: Modified4480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3483\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188771,7 +188771,7 @@ stage: Modified - name: Modified4481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188780,7 +188780,7 @@ stage: Modified - name: Modified4482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3484\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -188789,7 +188789,7 @@ stage: Modified - name: Modified4483 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188798,7 +188798,7 @@ stage: Modified - name: Modified4484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3485\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -188807,7 +188807,7 @@ stage: Modified - name: Modified4485 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188816,7 +188816,7 @@ stage: Modified - name: Modified4486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3486\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -188824,7 +188824,7 @@ stage: Modified - name: Modified4487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -188833,7 +188833,7 @@ stage: Modified - name: Modified4488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3487\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -188841,7 +188841,7 @@ stage: Modified - name: Modified4489 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188863,7 +188863,7 @@ stage: Modified - name: Modified4490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -188872,7 +188872,7 @@ stage: Modified - name: Modified4491 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188894,7 +188894,7 @@ stage: Modified - name: Modified4492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -188903,7 +188903,7 @@ stage: Modified - name: Modified4493 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188925,7 +188925,7 @@ stage: Modified - name: Modified4494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188933,7 +188933,7 @@ stage: Modified - name: Modified4495 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188955,7 +188955,7 @@ stage: Modified - name: Modified4496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -188963,7 +188963,7 @@ stage: Modified - name: Modified4497 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -188985,7 +188985,7 @@ stage: Modified - name: Modified4498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -188994,7 +188994,7 @@ stage: Modified - name: Modified4499 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189016,7 +189016,7 @@ stage: Modified - name: Modified4500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -189025,7 +189025,7 @@ stage: Modified - name: Modified4501 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189047,7 +189047,7 @@ stage: Modified - name: Modified4502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -189055,7 +189055,7 @@ stage: Modified - name: Modified4503 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189077,7 +189077,7 @@ stage: Modified - name: Modified4504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -189085,7 +189085,7 @@ stage: Modified - name: Modified4505 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3496\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189107,7 +189107,7 @@ stage: Modified - name: Modified4506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3496\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3496\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3496\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -189116,7 +189116,7 @@ stage: Modified - name: Modified4507 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3497\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189138,7 +189138,7 @@ stage: Modified - name: Modified4508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3497\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3497\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3497\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -189147,7 +189147,7 @@ stage: Modified - name: Modified4509 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3498\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189169,7 +189169,7 @@ stage: Modified - name: Modified4510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3498\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3498\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3498\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -189177,7 +189177,7 @@ stage: Modified - name: Modified4511 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3499\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189199,7 +189199,7 @@ stage: Modified - name: Modified4512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3499\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3499\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3499\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -189207,7 +189207,7 @@ stage: Modified - name: Modified4513 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3500\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189229,7 +189229,7 @@ stage: Modified - name: Modified4514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3500\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3500\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3500\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -189238,7 +189238,7 @@ stage: Modified - name: Modified4515 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3501\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189260,7 +189260,7 @@ stage: Modified - name: Modified4516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3501\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3501\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3501\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -189269,7 +189269,7 @@ stage: Modified - name: Modified4517 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3502\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189291,7 +189291,7 @@ stage: Modified - name: Modified4518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3502\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3502\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3502\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -189299,7 +189299,7 @@ stage: Modified - name: Modified4519 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3503\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189321,7 +189321,7 @@ stage: Modified - name: Modified4520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3503\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3503\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3503\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -189329,7 +189329,7 @@ stage: Modified - name: Modified4521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816966,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key", "arch": "[x64]", "timestamp": 1606816966, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189337,7 +189337,7 @@ stage: Modified - name: Modified4522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816966,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816966, "attributes": @@ -189346,7 +189346,7 @@ stage: Modified - name: Modified4523 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189354,7 +189354,7 @@ stage: Modified - name: Modified4524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189363,7 +189363,7 @@ stage: Modified - name: Modified4525 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189371,7 +189371,7 @@ stage: Modified - name: Modified4526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -189379,7 +189379,7 @@ stage: Modified - name: Modified4527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189387,7 +189387,7 @@ stage: Modified - name: Modified4528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -189395,7 +189395,7 @@ stage: Modified - name: Modified4529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189403,7 +189403,7 @@ stage: Modified - name: Modified4530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189412,7 +189412,7 @@ stage: Modified - name: Modified4531 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189420,7 +189420,7 @@ stage: Modified - name: Modified4532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189429,7 +189429,7 @@ stage: Modified - name: Modified4533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189437,7 +189437,7 @@ stage: Modified - name: Modified4534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -189445,7 +189445,7 @@ stage: Modified - name: Modified4535 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770051,"checksum":"ac9481622f5a7e8beca4726634e05865193c03c9"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189453,7 +189453,7 @@ stage: Modified - name: Modified4536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -189461,7 +189461,7 @@ stage: Modified - name: Modified4537 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189469,7 +189469,7 @@ stage: Modified - name: Modified4538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3512\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189478,7 +189478,7 @@ stage: Modified - name: Modified4539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189486,7 +189486,7 @@ stage: Modified - name: Modified4540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3513\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189495,7 +189495,7 @@ stage: Modified - name: Modified4541 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189503,7 +189503,7 @@ stage: Modified - name: Modified4542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3514\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -189511,7 +189511,7 @@ stage: Modified - name: Modified4543 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189519,7 +189519,7 @@ stage: Modified - name: Modified4544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3515\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -189527,7 +189527,7 @@ stage: Modified - name: Modified4545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189535,7 +189535,7 @@ stage: Modified - name: Modified4546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3516\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189544,7 +189544,7 @@ stage: Modified - name: Modified4547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189552,7 +189552,7 @@ stage: Modified - name: Modified4548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3517\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189561,7 +189561,7 @@ stage: Modified - name: Modified4549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189569,7 +189569,7 @@ stage: Modified - name: Modified4550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3518\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -189577,7 +189577,7 @@ stage: Modified - name: Modified4551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -189585,7 +189585,7 @@ stage: Modified - name: Modified4552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3519\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -189593,7 +189593,7 @@ stage: Modified - name: Modified4553 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189615,7 +189615,7 @@ stage: Modified - name: Modified4554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189624,7 +189624,7 @@ stage: Modified - name: Modified4555 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189646,7 +189646,7 @@ stage: Modified - name: Modified4556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189655,7 +189655,7 @@ stage: Modified - name: Modified4557 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189677,7 +189677,7 @@ stage: Modified - name: Modified4558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -189685,7 +189685,7 @@ stage: Modified - name: Modified4559 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189707,7 +189707,7 @@ stage: Modified - name: Modified4560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -189715,7 +189715,7 @@ stage: Modified - name: Modified4561 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189737,7 +189737,7 @@ stage: Modified - name: Modified4562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189746,7 +189746,7 @@ stage: Modified - name: Modified4563 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189768,7 +189768,7 @@ stage: Modified - name: Modified4564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189777,7 +189777,7 @@ stage: Modified - name: Modified4565 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189799,7 +189799,7 @@ stage: Modified - name: Modified4566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -189807,7 +189807,7 @@ stage: Modified - name: Modified4567 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189829,7 +189829,7 @@ stage: Modified - name: Modified4568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -189837,7 +189837,7 @@ stage: Modified - name: Modified4569 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3528\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189859,7 +189859,7 @@ stage: Modified - name: Modified4570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3528\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3528\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3528\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189868,7 +189868,7 @@ stage: Modified - name: Modified4571 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3529\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189890,7 +189890,7 @@ stage: Modified - name: Modified4572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3529\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3529\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3529\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189899,7 +189899,7 @@ stage: Modified - name: Modified4573 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3530\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189921,7 +189921,7 @@ stage: Modified - name: Modified4574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3530\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3530\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3530\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -189929,7 +189929,7 @@ stage: Modified - name: Modified4575 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3531\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189951,7 +189951,7 @@ stage: Modified - name: Modified4576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3531\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3531\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3531\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -189959,7 +189959,7 @@ stage: Modified - name: Modified4577 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3532\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -189981,7 +189981,7 @@ stage: Modified - name: Modified4578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3532\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3532\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3532\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -189990,7 +189990,7 @@ stage: Modified - name: Modified4579 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3533\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190012,7 +190012,7 @@ stage: Modified - name: Modified4580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3533\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3533\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3533\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -190021,7 +190021,7 @@ stage: Modified - name: Modified4581 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3534\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190043,7 +190043,7 @@ stage: Modified - name: Modified4582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3534\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3534\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3534\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190051,7 +190051,7 @@ stage: Modified - name: Modified4583 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3535\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190073,7 +190073,7 @@ stage: Modified - name: Modified4584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3535\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3535\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3535\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190081,7 +190081,7 @@ stage: Modified - name: Modified4585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -190089,7 +190089,7 @@ stage: Modified - name: Modified4586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -190098,7 +190098,7 @@ stage: Modified - name: Modified4587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -190106,7 +190106,7 @@ stage: Modified - name: Modified4588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -190115,7 +190115,7 @@ stage: Modified - name: Modified4589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -190123,7 +190123,7 @@ stage: Modified - name: Modified4590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190131,7 +190131,7 @@ stage: Modified - name: Modified4591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -190139,7 +190139,7 @@ stage: Modified - name: Modified4592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190147,7 +190147,7 @@ stage: Modified - name: Modified4593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816967,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key", "arch": "[x64]", "timestamp": 1606816967, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -190155,7 +190155,7 @@ stage: Modified - name: Modified4594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816967,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816967, "attributes": @@ -190164,7 +190164,7 @@ stage: Modified - name: Modified4595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key", "arch": "[x64]", "timestamp": 1606816968, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -190172,7 +190172,7 @@ stage: Modified - name: Modified4596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190181,7 +190181,7 @@ stage: Modified - name: Modified4597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key", "arch": "[x64]", "timestamp": 1606816968, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -190189,7 +190189,7 @@ stage: Modified - name: Modified4598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190197,7 +190197,7 @@ stage: Modified - name: Modified4599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770052,"checksum":"9f133382bca5d2bcb687847438551a0072cca511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key", "arch": "[x64]", "timestamp": 1606816968, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -190205,7 +190205,7 @@ stage: Modified - name: Modified4600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190213,7 +190213,7 @@ stage: Modified - name: Modified4601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3544\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3544\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3544\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190222,7 +190222,7 @@ stage: Modified - name: Modified4602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3545\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3545\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3545\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190231,7 +190231,7 @@ stage: Modified - name: Modified4603 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3546\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3546\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3546\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190239,7 +190239,7 @@ stage: Modified - name: Modified4604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3547\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3547\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3547\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190247,7 +190247,7 @@ stage: Modified - name: Modified4605 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3548\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3548\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3548\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190256,7 +190256,7 @@ stage: Modified - name: Modified4606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3549\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3549\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3549\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190265,7 +190265,7 @@ stage: Modified - name: Modified4607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3550\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3550\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3550\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190273,7 +190273,7 @@ stage: Modified - name: Modified4608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3551\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3551\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3551\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190281,7 +190281,7 @@ stage: Modified - name: Modified4609 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190302,7 +190302,7 @@ stage: Modified - name: Modified4610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190311,7 +190311,7 @@ stage: Modified - name: Modified4611 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190332,7 +190332,7 @@ stage: Modified - name: Modified4612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190341,7 +190341,7 @@ stage: Modified - name: Modified4613 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190362,7 +190362,7 @@ stage: Modified - name: Modified4614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190370,7 +190370,7 @@ stage: Modified - name: Modified4615 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190391,7 +190391,7 @@ stage: Modified - name: Modified4616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190399,7 +190399,7 @@ stage: Modified - name: Modified4617 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190420,7 +190420,7 @@ stage: Modified - name: Modified4618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190429,7 +190429,7 @@ stage: Modified - name: Modified4619 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190450,7 +190450,7 @@ stage: Modified - name: Modified4620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190459,7 +190459,7 @@ stage: Modified - name: Modified4621 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190480,7 +190480,7 @@ stage: Modified - name: Modified4622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190488,7 +190488,7 @@ stage: Modified - name: Modified4623 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190509,7 +190509,7 @@ stage: Modified - name: Modified4624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190517,7 +190517,7 @@ stage: Modified - name: Modified4625 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3560\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190538,7 +190538,7 @@ stage: Modified - name: Modified4626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3560\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3560\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3560\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190547,7 +190547,7 @@ stage: Modified - name: Modified4627 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3561\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190568,7 +190568,7 @@ stage: Modified - name: Modified4628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3561\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3561\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3561\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190577,7 +190577,7 @@ stage: Modified - name: Modified4629 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3562\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190598,7 +190598,7 @@ stage: Modified - name: Modified4630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3562\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3562\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3562\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190606,7 +190606,7 @@ stage: Modified - name: Modified4631 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3563\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190627,7 +190627,7 @@ stage: Modified - name: Modified4632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3563\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3563\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3563\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190635,7 +190635,7 @@ stage: Modified - name: Modified4633 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3564\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190656,7 +190656,7 @@ stage: Modified - name: Modified4634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3564\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3564\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3564\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190665,7 +190665,7 @@ stage: Modified - name: Modified4635 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3565\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190686,7 +190686,7 @@ stage: Modified - name: Modified4636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3565\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3565\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3565\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190695,7 +190695,7 @@ stage: Modified - name: Modified4637 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3566\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190716,7 +190716,7 @@ stage: Modified - name: Modified4638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3566\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3566\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3566\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190724,7 +190724,7 @@ stage: Modified - name: Modified4639 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3567\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190745,7 +190745,7 @@ stage: Modified - name: Modified4640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3567\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3567\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3567\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190753,14 +190753,14 @@ stage: Modified - name: Modified4641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key", "arch": "[x64]", "timestamp": 1606816968, "attributes": {"type": "registry_key", "mtime": 1606770052, "checksum": "14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"}}' stage: Modified - name: Modified4642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190769,14 +190769,14 @@ stage: Modified - name: Modified4643 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key", "arch": "[x64]", "timestamp": 1606816968, "attributes": {"type": "registry_key", "mtime": 1606770052, "checksum": "14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"}}' stage: Modified - name: Modified4644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190785,14 +190785,14 @@ stage: Modified - name: Modified4645 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key", "arch": "[x64]", "timestamp": 1606816968, "attributes": {"type": "registry_key", "mtime": 1606770052, "checksum": "14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"}}' stage: Modified - name: Modified4646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190800,14 +190800,14 @@ stage: Modified - name: Modified4647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key", "arch": "[x64]", "timestamp": 1606816968, "attributes": {"type": "registry_key", "mtime": 1606770052, "checksum": "14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"}}' stage: Modified - name: Modified4648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190815,14 +190815,14 @@ stage: Modified - name: Modified4649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key", "arch": "[x64]", "timestamp": 1606816968, "attributes": {"type": "registry_key", "mtime": 1606770052, "checksum": "14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"}}' stage: Modified - name: Modified4650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190831,14 +190831,14 @@ stage: Modified - name: Modified4651 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key", "arch": "[x64]", "timestamp": 1606816968, "attributes": {"type": "registry_key", "mtime": 1606770052, "checksum": "14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"}}' stage: Modified - name: Modified4652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190847,14 +190847,14 @@ stage: Modified - name: Modified4653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key", "arch": "[x64]", "timestamp": 1606816968, "attributes": {"type": "registry_key", "mtime": 1606770052, "checksum": "14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"}}' stage: Modified - name: Modified4654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190862,14 +190862,14 @@ stage: Modified - name: Modified4655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816968,"attributes":{"type":"registry_key","mtime":1606770052,"checksum":"14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key", "arch": "[x64]", "timestamp": 1606816968, "attributes": {"type": "registry_key", "mtime": 1606770052, "checksum": "14dc1b51035ef53fa6eeaa01e98e14d584dbcab7"}}' stage: Modified - name: Modified4656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190877,7 +190877,7 @@ stage: Modified - name: Modified4657 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3576\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3576\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3576\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190886,7 +190886,7 @@ stage: Modified - name: Modified4658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3577\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3577\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816968,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3577\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816968, "attributes": @@ -190895,7 +190895,7 @@ stage: Modified - name: Modified4659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3578\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3578\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3578\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190903,7 +190903,7 @@ stage: Modified - name: Modified4660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3579\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3579\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3579\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", @@ -190911,7 +190911,7 @@ stage: Modified - name: Modified4661 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3580\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3580\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3580\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -190920,7 +190920,7 @@ stage: Modified - name: Modified4662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3581\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3581\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3581\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -190929,7 +190929,7 @@ stage: Modified - name: Modified4663 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3582\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3582\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3582\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190937,7 +190937,7 @@ stage: Modified - name: Modified4664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3583\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3583\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","checksum":"139bf70628b6c77050dfb32a8ac810351df44604"},"changed_attributes":["md5"],"old_attributes":{"type":"registry_value","hash_md5":"b60ed88355ac3f6898fd8a7ab1734d06","checksum":"fcc71e0cb4535b6c55d8340171a81fac54191bc5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3583\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "hash_md5": "9ae73c65f418e6f79ceb4f0e4a4b98d5", "checksum": @@ -190945,7 +190945,7 @@ stage: Modified - name: Modified4665 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -190968,7 +190968,7 @@ stage: Modified - name: Modified4666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -190978,7 +190978,7 @@ stage: Modified - name: Modified4667 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191001,7 +191001,7 @@ stage: Modified - name: Modified4668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191011,7 +191011,7 @@ stage: Modified - name: Modified4669 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191034,7 +191034,7 @@ stage: Modified - name: Modified4670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -191043,7 +191043,7 @@ stage: Modified - name: Modified4671 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191066,7 +191066,7 @@ stage: Modified - name: Modified4672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -191075,7 +191075,7 @@ stage: Modified - name: Modified4673 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191098,7 +191098,7 @@ stage: Modified - name: Modified4674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191107,7 +191107,7 @@ stage: Modified - name: Modified4675 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191130,7 +191130,7 @@ stage: Modified - name: Modified4676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191139,7 +191139,7 @@ stage: Modified - name: Modified4677 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191162,7 +191162,7 @@ stage: Modified - name: Modified4678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -191170,7 +191170,7 @@ stage: Modified - name: Modified4679 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191193,7 +191193,7 @@ stage: Modified - name: Modified4680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -191201,7 +191201,7 @@ stage: Modified - name: Modified4681 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3592\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191224,7 +191224,7 @@ stage: Modified - name: Modified4682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3592\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3592\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3592\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191234,7 +191234,7 @@ stage: Modified - name: Modified4683 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3593\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191257,7 +191257,7 @@ stage: Modified - name: Modified4684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3593\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3593\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3593\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191267,7 +191267,7 @@ stage: Modified - name: Modified4685 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3594\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191290,7 +191290,7 @@ stage: Modified - name: Modified4686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3594\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3594\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3594\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -191299,7 +191299,7 @@ stage: Modified - name: Modified4687 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3595\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191322,7 +191322,7 @@ stage: Modified - name: Modified4688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3595\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3595\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3595\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -191331,7 +191331,7 @@ stage: Modified - name: Modified4689 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3596\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191354,7 +191354,7 @@ stage: Modified - name: Modified4690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3596\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3596\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3596\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191363,7 +191363,7 @@ stage: Modified - name: Modified4691 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3597\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191386,7 +191386,7 @@ stage: Modified - name: Modified4692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3597\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3597\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3597\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191395,7 +191395,7 @@ stage: Modified - name: Modified4693 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3598\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191418,7 +191418,7 @@ stage: Modified - name: Modified4694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3598\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3598\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3598\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -191426,7 +191426,7 @@ stage: Modified - name: Modified4695 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3599\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191449,7 +191449,7 @@ stage: Modified - name: Modified4696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3599\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3599\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3599\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -191457,7 +191457,7 @@ stage: Modified - name: Modified4697 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191466,7 +191466,7 @@ stage: Modified - name: Modified4698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191476,7 +191476,7 @@ stage: Modified - name: Modified4699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191485,7 +191485,7 @@ stage: Modified - name: Modified4700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191495,7 +191495,7 @@ stage: Modified - name: Modified4701 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191504,7 +191504,7 @@ stage: Modified - name: Modified4702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -191513,7 +191513,7 @@ stage: Modified - name: Modified4703 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191522,7 +191522,7 @@ stage: Modified - name: Modified4704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -191531,7 +191531,7 @@ stage: Modified - name: Modified4705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191540,7 +191540,7 @@ stage: Modified - name: Modified4706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191549,7 +191549,7 @@ stage: Modified - name: Modified4707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191558,7 +191558,7 @@ stage: Modified - name: Modified4708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191567,7 +191567,7 @@ stage: Modified - name: Modified4709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191576,7 +191576,7 @@ stage: Modified - name: Modified4710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -191584,7 +191584,7 @@ stage: Modified - name: Modified4711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770053,"checksum":"4a3fffecb0a2063c47bb815bf461d1fc53ecb0f2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191593,7 +191593,7 @@ stage: Modified - name: Modified4712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -191601,7 +191601,7 @@ stage: Modified - name: Modified4713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191610,7 +191610,7 @@ stage: Modified - name: Modified4714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3608\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191620,7 +191620,7 @@ stage: Modified - name: Modified4715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191629,7 +191629,7 @@ stage: Modified - name: Modified4716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3609\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191639,7 +191639,7 @@ stage: Modified - name: Modified4717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191648,7 +191648,7 @@ stage: Modified - name: Modified4718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3610\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -191657,7 +191657,7 @@ stage: Modified - name: Modified4719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191666,7 +191666,7 @@ stage: Modified - name: Modified4720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3611\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -191675,7 +191675,7 @@ stage: Modified - name: Modified4721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191684,7 +191684,7 @@ stage: Modified - name: Modified4722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3612\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191693,7 +191693,7 @@ stage: Modified - name: Modified4723 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191702,7 +191702,7 @@ stage: Modified - name: Modified4724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3613\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191711,7 +191711,7 @@ stage: Modified - name: Modified4725 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191720,7 +191720,7 @@ stage: Modified - name: Modified4726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3614\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -191728,7 +191728,7 @@ stage: Modified - name: Modified4727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key", "arch": "[x64]", "timestamp": 1606816969, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -191737,7 +191737,7 @@ stage: Modified - name: Modified4728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3615\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -191745,7 +191745,7 @@ stage: Modified - name: Modified4729 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816969,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191767,7 +191767,7 @@ stage: Modified - name: Modified4730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816969,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816969, "attributes": @@ -191777,7 +191777,7 @@ stage: Modified - name: Modified4731 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191799,7 +191799,7 @@ stage: Modified - name: Modified4732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -191809,7 +191809,7 @@ stage: Modified - name: Modified4733 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191831,7 +191831,7 @@ stage: Modified - name: Modified4734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -191840,7 +191840,7 @@ stage: Modified - name: Modified4735 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191862,7 +191862,7 @@ stage: Modified - name: Modified4736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -191871,7 +191871,7 @@ stage: Modified - name: Modified4737 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191893,7 +191893,7 @@ stage: Modified - name: Modified4738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -191902,7 +191902,7 @@ stage: Modified - name: Modified4739 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191924,7 +191924,7 @@ stage: Modified - name: Modified4740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -191933,7 +191933,7 @@ stage: Modified - name: Modified4741 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191955,7 +191955,7 @@ stage: Modified - name: Modified4742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -191963,7 +191963,7 @@ stage: Modified - name: Modified4743 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -191985,7 +191985,7 @@ stage: Modified - name: Modified4744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -191993,7 +191993,7 @@ stage: Modified - name: Modified4745 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3624\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192015,7 +192015,7 @@ stage: Modified - name: Modified4746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3624\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3624\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3624\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192025,7 +192025,7 @@ stage: Modified - name: Modified4747 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3625\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192047,7 +192047,7 @@ stage: Modified - name: Modified4748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3625\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3625\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3625\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192057,7 +192057,7 @@ stage: Modified - name: Modified4749 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3626\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192079,7 +192079,7 @@ stage: Modified - name: Modified4750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3626\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3626\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3626\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -192088,7 +192088,7 @@ stage: Modified - name: Modified4751 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3627\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192110,7 +192110,7 @@ stage: Modified - name: Modified4752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3627\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3627\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3627\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -192119,7 +192119,7 @@ stage: Modified - name: Modified4753 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3628\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192141,7 +192141,7 @@ stage: Modified - name: Modified4754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3628\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3628\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3628\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192150,7 +192150,7 @@ stage: Modified - name: Modified4755 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3629\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192172,7 +192172,7 @@ stage: Modified - name: Modified4756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3629\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3629\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3629\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192181,7 +192181,7 @@ stage: Modified - name: Modified4757 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3630\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192203,7 +192203,7 @@ stage: Modified - name: Modified4758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3630\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3630\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3630\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -192211,7 +192211,7 @@ stage: Modified - name: Modified4759 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3631\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192233,7 +192233,7 @@ stage: Modified - name: Modified4760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3631\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3631\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3631\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -192241,7 +192241,7 @@ stage: Modified - name: Modified4761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192249,7 +192249,7 @@ stage: Modified - name: Modified4762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192259,7 +192259,7 @@ stage: Modified - name: Modified4763 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192267,7 +192267,7 @@ stage: Modified - name: Modified4764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192277,7 +192277,7 @@ stage: Modified - name: Modified4765 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192285,7 +192285,7 @@ stage: Modified - name: Modified4766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -192294,7 +192294,7 @@ stage: Modified - name: Modified4767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192302,7 +192302,7 @@ stage: Modified - name: Modified4768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -192311,7 +192311,7 @@ stage: Modified - name: Modified4769 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192319,7 +192319,7 @@ stage: Modified - name: Modified4770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192328,7 +192328,7 @@ stage: Modified - name: Modified4771 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192336,7 +192336,7 @@ stage: Modified - name: Modified4772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192345,7 +192345,7 @@ stage: Modified - name: Modified4773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192353,7 +192353,7 @@ stage: Modified - name: Modified4774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -192361,7 +192361,7 @@ stage: Modified - name: Modified4775 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770053,"checksum":"6ca41b19ced57ae2a21cedfe1e85c6ec08ae1ea8"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192369,7 +192369,7 @@ stage: Modified - name: Modified4776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -192377,7 +192377,7 @@ stage: Modified - name: Modified4777 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192385,7 +192385,7 @@ stage: Modified - name: Modified4778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3640\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192395,7 +192395,7 @@ stage: Modified - name: Modified4779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192403,7 +192403,7 @@ stage: Modified - name: Modified4780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3641\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192413,7 +192413,7 @@ stage: Modified - name: Modified4781 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192421,7 +192421,7 @@ stage: Modified - name: Modified4782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3642\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -192430,7 +192430,7 @@ stage: Modified - name: Modified4783 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192438,7 +192438,7 @@ stage: Modified - name: Modified4784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3643\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -192447,7 +192447,7 @@ stage: Modified - name: Modified4785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192455,7 +192455,7 @@ stage: Modified - name: Modified4786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3644\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192464,7 +192464,7 @@ stage: Modified - name: Modified4787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192472,7 +192472,7 @@ stage: Modified - name: Modified4788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3645\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192481,7 +192481,7 @@ stage: Modified - name: Modified4789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192489,7 +192489,7 @@ stage: Modified - name: Modified4790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3646\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -192497,7 +192497,7 @@ stage: Modified - name: Modified4791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key", "arch": "[x64]", "timestamp": 1606816970, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -192505,7 +192505,7 @@ stage: Modified - name: Modified4792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3647\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -192513,7 +192513,7 @@ stage: Modified - name: Modified4793 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192535,7 +192535,7 @@ stage: Modified - name: Modified4794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192545,7 +192545,7 @@ stage: Modified - name: Modified4795 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192567,7 +192567,7 @@ stage: Modified - name: Modified4796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192577,7 +192577,7 @@ stage: Modified - name: Modified4797 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192599,7 +192599,7 @@ stage: Modified - name: Modified4798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -192608,7 +192608,7 @@ stage: Modified - name: Modified4799 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192630,7 +192630,7 @@ stage: Modified - name: Modified4800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -192639,7 +192639,7 @@ stage: Modified - name: Modified4801 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192661,7 +192661,7 @@ stage: Modified - name: Modified4802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192670,7 +192670,7 @@ stage: Modified - name: Modified4803 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816970,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192692,7 +192692,7 @@ stage: Modified - name: Modified4804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816970,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816970, "attributes": @@ -192701,7 +192701,7 @@ stage: Modified - name: Modified4805 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192723,7 +192723,7 @@ stage: Modified - name: Modified4806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -192731,7 +192731,7 @@ stage: Modified - name: Modified4807 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192753,7 +192753,7 @@ stage: Modified - name: Modified4808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -192761,7 +192761,7 @@ stage: Modified - name: Modified4809 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3656\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192783,7 +192783,7 @@ stage: Modified - name: Modified4810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3656\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3656\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3656\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -192793,7 +192793,7 @@ stage: Modified - name: Modified4811 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3657\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192815,7 +192815,7 @@ stage: Modified - name: Modified4812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3657\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3657\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3657\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -192825,7 +192825,7 @@ stage: Modified - name: Modified4813 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3658\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192847,7 +192847,7 @@ stage: Modified - name: Modified4814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3658\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3658\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3658\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -192856,7 +192856,7 @@ stage: Modified - name: Modified4815 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3659\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192878,7 +192878,7 @@ stage: Modified - name: Modified4816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3659\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3659\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3659\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -192887,7 +192887,7 @@ stage: Modified - name: Modified4817 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3660\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192909,7 +192909,7 @@ stage: Modified - name: Modified4818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3660\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3660\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3660\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -192918,7 +192918,7 @@ stage: Modified - name: Modified4819 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3661\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192940,7 +192940,7 @@ stage: Modified - name: Modified4820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3661\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3661\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3661\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -192949,7 +192949,7 @@ stage: Modified - name: Modified4821 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3662\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -192971,7 +192971,7 @@ stage: Modified - name: Modified4822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3662\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3662\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3662\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -192979,7 +192979,7 @@ stage: Modified - name: Modified4823 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3663\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193001,7 +193001,7 @@ stage: Modified - name: Modified4824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3663\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3663\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3663\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193009,7 +193009,7 @@ stage: Modified - name: Modified4825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key", "arch": "[x64]", "timestamp": 1606816971, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -193017,7 +193017,7 @@ stage: Modified - name: Modified4826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193027,7 +193027,7 @@ stage: Modified - name: Modified4827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key", "arch": "[x64]", "timestamp": 1606816971, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -193035,7 +193035,7 @@ stage: Modified - name: Modified4828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193045,7 +193045,7 @@ stage: Modified - name: Modified4829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key", "arch": "[x64]", "timestamp": 1606816971, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -193053,7 +193053,7 @@ stage: Modified - name: Modified4830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193062,7 +193062,7 @@ stage: Modified - name: Modified4831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key", "arch": "[x64]", "timestamp": 1606816971, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -193070,7 +193070,7 @@ stage: Modified - name: Modified4832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193079,7 +193079,7 @@ stage: Modified - name: Modified4833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key", "arch": "[x64]", "timestamp": 1606816971, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -193087,7 +193087,7 @@ stage: Modified - name: Modified4834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193096,7 +193096,7 @@ stage: Modified - name: Modified4835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key", "arch": "[x64]", "timestamp": 1606816971, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -193104,7 +193104,7 @@ stage: Modified - name: Modified4836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193113,7 +193113,7 @@ stage: Modified - name: Modified4837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key", "arch": "[x64]", "timestamp": 1606816971, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -193121,7 +193121,7 @@ stage: Modified - name: Modified4838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193129,7 +193129,7 @@ stage: Modified - name: Modified4839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770054,"checksum":"ac2e1688448495005c806809c08b78ffe6a4426d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key", "arch": "[x64]", "timestamp": 1606816971, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -193137,7 +193137,7 @@ stage: Modified - name: Modified4840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193145,7 +193145,7 @@ stage: Modified - name: Modified4841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3672\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3672\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3672\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193155,7 +193155,7 @@ stage: Modified - name: Modified4842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3673\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3673\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3673\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193165,7 +193165,7 @@ stage: Modified - name: Modified4843 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3674\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3674\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3674\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193174,7 +193174,7 @@ stage: Modified - name: Modified4844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3675\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3675\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3675\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193183,7 +193183,7 @@ stage: Modified - name: Modified4845 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3676\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3676\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3676\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193192,7 +193192,7 @@ stage: Modified - name: Modified4846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3677\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3677\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3677\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193201,7 +193201,7 @@ stage: Modified - name: Modified4847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3678\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3678\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3678\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193209,7 +193209,7 @@ stage: Modified - name: Modified4848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3679\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3679\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3679\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193217,7 +193217,7 @@ stage: Modified - name: Modified4849 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193238,7 +193238,7 @@ stage: Modified - name: Modified4850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193248,7 +193248,7 @@ stage: Modified - name: Modified4851 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193269,7 +193269,7 @@ stage: Modified - name: Modified4852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193279,7 +193279,7 @@ stage: Modified - name: Modified4853 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193300,7 +193300,7 @@ stage: Modified - name: Modified4854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193309,7 +193309,7 @@ stage: Modified - name: Modified4855 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193330,7 +193330,7 @@ stage: Modified - name: Modified4856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193339,7 +193339,7 @@ stage: Modified - name: Modified4857 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193360,7 +193360,7 @@ stage: Modified - name: Modified4858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193369,7 +193369,7 @@ stage: Modified - name: Modified4859 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193390,7 +193390,7 @@ stage: Modified - name: Modified4860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193399,7 +193399,7 @@ stage: Modified - name: Modified4861 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193420,7 +193420,7 @@ stage: Modified - name: Modified4862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193428,7 +193428,7 @@ stage: Modified - name: Modified4863 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193449,7 +193449,7 @@ stage: Modified - name: Modified4864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193457,7 +193457,7 @@ stage: Modified - name: Modified4865 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3688\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193478,7 +193478,7 @@ stage: Modified - name: Modified4866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3688\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3688\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3688\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193488,7 +193488,7 @@ stage: Modified - name: Modified4867 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3689\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193509,7 +193509,7 @@ stage: Modified - name: Modified4868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3689\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3689\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3689\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193519,7 +193519,7 @@ stage: Modified - name: Modified4869 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3690\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193540,7 +193540,7 @@ stage: Modified - name: Modified4870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3690\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3690\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3690\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193549,7 +193549,7 @@ stage: Modified - name: Modified4871 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3691\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193570,7 +193570,7 @@ stage: Modified - name: Modified4872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3691\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3691\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3691\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193579,7 +193579,7 @@ stage: Modified - name: Modified4873 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3692\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816971,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193600,7 +193600,7 @@ stage: Modified - name: Modified4874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3692\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3692\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816971,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3692\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816971, "attributes": @@ -193609,7 +193609,7 @@ stage: Modified - name: Modified4875 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3693\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193630,7 +193630,7 @@ stage: Modified - name: Modified4876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3693\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3693\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3693\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -193639,7 +193639,7 @@ stage: Modified - name: Modified4877 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3694\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193660,7 +193660,7 @@ stage: Modified - name: Modified4878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3694\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3694\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3694\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193668,7 +193668,7 @@ stage: Modified - name: Modified4879 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3695\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193689,7 +193689,7 @@ stage: Modified - name: Modified4880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3695\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3695\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3695\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193697,14 +193697,14 @@ stage: Modified - name: Modified4881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770054,"checksum":"a9331e1410f128ee88e8fae98e80f6c07ddd0862"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770054,"checksum":"a9331e1410f128ee88e8fae98e80f6c07ddd0862"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "mtime": 1606770054, "checksum": "a9331e1410f128ee88e8fae98e80f6c07ddd0862"}}' stage: Modified - name: Modified4882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -193714,14 +193714,14 @@ stage: Modified - name: Modified4883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770054,"checksum":"a9331e1410f128ee88e8fae98e80f6c07ddd0862"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770054,"checksum":"a9331e1410f128ee88e8fae98e80f6c07ddd0862"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "mtime": 1606770054, "checksum": "a9331e1410f128ee88e8fae98e80f6c07ddd0862"}}' stage: Modified - name: Modified4884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -193731,14 +193731,14 @@ stage: Modified - name: Modified4885 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "mtime": 1606770055, "checksum": "9c80d12585c44a0d3fccbe135c0f33dfb81f3905"}}' stage: Modified - name: Modified4886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193747,14 +193747,14 @@ stage: Modified - name: Modified4887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "mtime": 1606770055, "checksum": "9c80d12585c44a0d3fccbe135c0f33dfb81f3905"}}' stage: Modified - name: Modified4888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193763,14 +193763,14 @@ stage: Modified - name: Modified4889 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "mtime": 1606770055, "checksum": "9c80d12585c44a0d3fccbe135c0f33dfb81f3905"}}' stage: Modified - name: Modified4890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -193779,14 +193779,14 @@ stage: Modified - name: Modified4891 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "mtime": 1606770055, "checksum": "9c80d12585c44a0d3fccbe135c0f33dfb81f3905"}}' stage: Modified - name: Modified4892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -193795,14 +193795,14 @@ stage: Modified - name: Modified4893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "mtime": 1606770055, "checksum": "9c80d12585c44a0d3fccbe135c0f33dfb81f3905"}}' stage: Modified - name: Modified4894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193810,14 +193810,14 @@ stage: Modified - name: Modified4895 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","mtime":1606770055,"checksum":"9c80d12585c44a0d3fccbe135c0f33dfb81f3905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "mtime": 1606770055, "checksum": "9c80d12585c44a0d3fccbe135c0f33dfb81f3905"}}' stage: Modified - name: Modified4896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193825,7 +193825,7 @@ stage: Modified - name: Modified4897 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3704\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3704\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3704\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -193835,7 +193835,7 @@ stage: Modified - name: Modified4898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3705\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3705\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3705\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -193845,7 +193845,7 @@ stage: Modified - name: Modified4899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3706\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3706\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3706\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193854,7 +193854,7 @@ stage: Modified - name: Modified4900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3707\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3707\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3707\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "hash_sha256": @@ -193863,7 +193863,7 @@ stage: Modified - name: Modified4901 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3708\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3708\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3708\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -193872,7 +193872,7 @@ stage: Modified - name: Modified4902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3709\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3709\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3709\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -193881,7 +193881,7 @@ stage: Modified - name: Modified4903 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3710\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3710\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3710\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193889,7 +193889,7 @@ stage: Modified - name: Modified4904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3711\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3711\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","size":9,"hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["size","sha256"],"old_attributes":{"type":"registry_value","size":6,"hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3711\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "size": 9, "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193897,7 +193897,7 @@ stage: Modified - name: Modified4905 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193920,7 +193920,7 @@ stage: Modified - name: Modified4906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -193929,7 +193929,7 @@ stage: Modified - name: Modified4907 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193952,7 +193952,7 @@ stage: Modified - name: Modified4908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -193961,7 +193961,7 @@ stage: Modified - name: Modified4909 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -193984,7 +193984,7 @@ stage: Modified - name: Modified4910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -193992,7 +193992,7 @@ stage: Modified - name: Modified4911 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194015,7 +194015,7 @@ stage: Modified - name: Modified4912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194023,7 +194023,7 @@ stage: Modified - name: Modified4913 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194046,7 +194046,7 @@ stage: Modified - name: Modified4914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -194055,7 +194055,7 @@ stage: Modified - name: Modified4915 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194078,7 +194078,7 @@ stage: Modified - name: Modified4916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -194087,7 +194087,7 @@ stage: Modified - name: Modified4917 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194110,7 +194110,7 @@ stage: Modified - name: Modified4918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194118,7 +194118,7 @@ stage: Modified - name: Modified4919 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194141,7 +194141,7 @@ stage: Modified - name: Modified4920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194149,7 +194149,7 @@ stage: Modified - name: Modified4921 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3720\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194172,7 +194172,7 @@ stage: Modified - name: Modified4922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3720\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3720\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3720\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -194181,7 +194181,7 @@ stage: Modified - name: Modified4923 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3721\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194204,7 +194204,7 @@ stage: Modified - name: Modified4924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3721\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3721\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3721\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -194213,7 +194213,7 @@ stage: Modified - name: Modified4925 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3722\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194236,7 +194236,7 @@ stage: Modified - name: Modified4926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3722\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3722\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3722\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194244,7 +194244,7 @@ stage: Modified - name: Modified4927 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3723\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194267,7 +194267,7 @@ stage: Modified - name: Modified4928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3723\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3723\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3723\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194275,7 +194275,7 @@ stage: Modified - name: Modified4929 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3724\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194298,7 +194298,7 @@ stage: Modified - name: Modified4930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3724\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3724\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3724\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -194307,7 +194307,7 @@ stage: Modified - name: Modified4931 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3725\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194330,7 +194330,7 @@ stage: Modified - name: Modified4932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3725\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3725\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3725\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -194339,7 +194339,7 @@ stage: Modified - name: Modified4933 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3726\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194362,7 +194362,7 @@ stage: Modified - name: Modified4934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3726\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3726\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3726\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194370,7 +194370,7 @@ stage: Modified - name: Modified4935 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3727\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194393,7 +194393,7 @@ stage: Modified - name: Modified4936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3727\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3727\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3727\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194401,7 +194401,7 @@ stage: Modified - name: Modified4937 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194410,7 +194410,7 @@ stage: Modified - name: Modified4938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -194419,7 +194419,7 @@ stage: Modified - name: Modified4939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194428,7 +194428,7 @@ stage: Modified - name: Modified4940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -194437,7 +194437,7 @@ stage: Modified - name: Modified4941 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194446,7 +194446,7 @@ stage: Modified - name: Modified4942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194454,7 +194454,7 @@ stage: Modified - name: Modified4943 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194463,7 +194463,7 @@ stage: Modified - name: Modified4944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194471,7 +194471,7 @@ stage: Modified - name: Modified4945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194480,7 +194480,7 @@ stage: Modified - name: Modified4946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -194489,7 +194489,7 @@ stage: Modified - name: Modified4947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816972,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key", "arch": "[x64]", "timestamp": 1606816972, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194498,7 +194498,7 @@ stage: Modified - name: Modified4948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816972,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816972, "attributes": @@ -194507,7 +194507,7 @@ stage: Modified - name: Modified4949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194516,7 +194516,7 @@ stage: Modified - name: Modified4950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194524,7 +194524,7 @@ stage: Modified - name: Modified4951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770055,"checksum":"08ff3ad04b7411b45be34acf976e10fdf6e733cd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194533,7 +194533,7 @@ stage: Modified - name: Modified4952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194541,7 +194541,7 @@ stage: Modified - name: Modified4953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194550,7 +194550,7 @@ stage: Modified - name: Modified4954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3736\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -194559,7 +194559,7 @@ stage: Modified - name: Modified4955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194568,7 +194568,7 @@ stage: Modified - name: Modified4956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3737\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -194577,7 +194577,7 @@ stage: Modified - name: Modified4957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194586,7 +194586,7 @@ stage: Modified - name: Modified4958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3738\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194594,7 +194594,7 @@ stage: Modified - name: Modified4959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194603,7 +194603,7 @@ stage: Modified - name: Modified4960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3739\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194611,7 +194611,7 @@ stage: Modified - name: Modified4961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194620,7 +194620,7 @@ stage: Modified - name: Modified4962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3740\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -194629,7 +194629,7 @@ stage: Modified - name: Modified4963 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194638,7 +194638,7 @@ stage: Modified - name: Modified4964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3741\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -194647,7 +194647,7 @@ stage: Modified - name: Modified4965 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194656,7 +194656,7 @@ stage: Modified - name: Modified4966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3742\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194664,7 +194664,7 @@ stage: Modified - name: Modified4967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -194673,7 +194673,7 @@ stage: Modified - name: Modified4968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3743\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194681,7 +194681,7 @@ stage: Modified - name: Modified4969 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194703,7 +194703,7 @@ stage: Modified - name: Modified4970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -194712,7 +194712,7 @@ stage: Modified - name: Modified4971 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194734,7 +194734,7 @@ stage: Modified - name: Modified4972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -194743,7 +194743,7 @@ stage: Modified - name: Modified4973 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194765,7 +194765,7 @@ stage: Modified - name: Modified4974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194773,7 +194773,7 @@ stage: Modified - name: Modified4975 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194795,7 +194795,7 @@ stage: Modified - name: Modified4976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194803,7 +194803,7 @@ stage: Modified - name: Modified4977 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194825,7 +194825,7 @@ stage: Modified - name: Modified4978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -194834,7 +194834,7 @@ stage: Modified - name: Modified4979 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194856,7 +194856,7 @@ stage: Modified - name: Modified4980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -194865,7 +194865,7 @@ stage: Modified - name: Modified4981 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194887,7 +194887,7 @@ stage: Modified - name: Modified4982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194895,7 +194895,7 @@ stage: Modified - name: Modified4983 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194917,7 +194917,7 @@ stage: Modified - name: Modified4984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -194925,7 +194925,7 @@ stage: Modified - name: Modified4985 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3752\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194947,7 +194947,7 @@ stage: Modified - name: Modified4986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3752\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3752\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3752\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -194956,7 +194956,7 @@ stage: Modified - name: Modified4987 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3753\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -194978,7 +194978,7 @@ stage: Modified - name: Modified4988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3753\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3753\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3753\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -194987,7 +194987,7 @@ stage: Modified - name: Modified4989 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3754\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195009,7 +195009,7 @@ stage: Modified - name: Modified4990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3754\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3754\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3754\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195017,7 +195017,7 @@ stage: Modified - name: Modified4991 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3755\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195039,7 +195039,7 @@ stage: Modified - name: Modified4992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3755\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3755\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3755\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195047,7 +195047,7 @@ stage: Modified - name: Modified4993 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3756\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195069,7 +195069,7 @@ stage: Modified - name: Modified4994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3756\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3756\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3756\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -195078,7 +195078,7 @@ stage: Modified - name: Modified4995 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3757\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195100,7 +195100,7 @@ stage: Modified - name: Modified4996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3757\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3757\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3757\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -195109,7 +195109,7 @@ stage: Modified - name: Modified4997 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3758\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195131,7 +195131,7 @@ stage: Modified - name: Modified4998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3758\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3758\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3758\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195139,7 +195139,7 @@ stage: Modified - name: Modified4999 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3759\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195161,7 +195161,7 @@ stage: Modified - name: Modified5000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3759\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3759\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3759\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195169,7 +195169,7 @@ stage: Modified - name: Modified5001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195177,7 +195177,7 @@ stage: Modified - name: Modified5002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -195186,7 +195186,7 @@ stage: Modified - name: Modified5003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195194,7 +195194,7 @@ stage: Modified - name: Modified5004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -195203,7 +195203,7 @@ stage: Modified - name: Modified5005 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195211,7 +195211,7 @@ stage: Modified - name: Modified5006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195219,7 +195219,7 @@ stage: Modified - name: Modified5007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195227,7 +195227,7 @@ stage: Modified - name: Modified5008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195235,7 +195235,7 @@ stage: Modified - name: Modified5009 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195243,7 +195243,7 @@ stage: Modified - name: Modified5010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -195252,7 +195252,7 @@ stage: Modified - name: Modified5011 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195260,7 +195260,7 @@ stage: Modified - name: Modified5012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -195269,7 +195269,7 @@ stage: Modified - name: Modified5013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195277,7 +195277,7 @@ stage: Modified - name: Modified5014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195285,7 +195285,7 @@ stage: Modified - name: Modified5015 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770056,"checksum":"e629732fbc057895041d975b7edda0e58294c9e2"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195293,7 +195293,7 @@ stage: Modified - name: Modified5016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195301,7 +195301,7 @@ stage: Modified - name: Modified5017 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195309,7 +195309,7 @@ stage: Modified - name: Modified5018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3768\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -195318,7 +195318,7 @@ stage: Modified - name: Modified5019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195326,7 +195326,7 @@ stage: Modified - name: Modified5020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3769\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -195335,7 +195335,7 @@ stage: Modified - name: Modified5021 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195343,7 +195343,7 @@ stage: Modified - name: Modified5022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3770\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195351,7 +195351,7 @@ stage: Modified - name: Modified5023 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195359,7 +195359,7 @@ stage: Modified - name: Modified5024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3771\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195367,7 +195367,7 @@ stage: Modified - name: Modified5025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195375,7 +195375,7 @@ stage: Modified - name: Modified5026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3772\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -195384,7 +195384,7 @@ stage: Modified - name: Modified5027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816973,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key", "arch": "[x64]", "timestamp": 1606816973, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195392,7 +195392,7 @@ stage: Modified - name: Modified5028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816973,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3773\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816973, "attributes": @@ -195401,7 +195401,7 @@ stage: Modified - name: Modified5029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key", "arch": "[x64]", "timestamp": 1606816974, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195409,7 +195409,7 @@ stage: Modified - name: Modified5030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3774\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195417,7 +195417,7 @@ stage: Modified - name: Modified5031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key", "arch": "[x64]", "timestamp": 1606816974, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -195425,7 +195425,7 @@ stage: Modified - name: Modified5032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3775\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195433,7 +195433,7 @@ stage: Modified - name: Modified5033 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195455,7 +195455,7 @@ stage: Modified - name: Modified5034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -195464,7 +195464,7 @@ stage: Modified - name: Modified5035 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195486,7 +195486,7 @@ stage: Modified - name: Modified5036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -195495,7 +195495,7 @@ stage: Modified - name: Modified5037 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195517,7 +195517,7 @@ stage: Modified - name: Modified5038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195525,7 +195525,7 @@ stage: Modified - name: Modified5039 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195547,7 +195547,7 @@ stage: Modified - name: Modified5040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195555,7 +195555,7 @@ stage: Modified - name: Modified5041 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195577,7 +195577,7 @@ stage: Modified - name: Modified5042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -195586,7 +195586,7 @@ stage: Modified - name: Modified5043 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195608,7 +195608,7 @@ stage: Modified - name: Modified5044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -195617,7 +195617,7 @@ stage: Modified - name: Modified5045 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195639,7 +195639,7 @@ stage: Modified - name: Modified5046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195647,7 +195647,7 @@ stage: Modified - name: Modified5047 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195669,7 +195669,7 @@ stage: Modified - name: Modified5048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195677,7 +195677,7 @@ stage: Modified - name: Modified5049 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3784\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195699,7 +195699,7 @@ stage: Modified - name: Modified5050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3784\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3784\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3784\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -195708,7 +195708,7 @@ stage: Modified - name: Modified5051 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3785\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195730,7 +195730,7 @@ stage: Modified - name: Modified5052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3785\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3785\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3785\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -195739,7 +195739,7 @@ stage: Modified - name: Modified5053 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3786\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195761,7 +195761,7 @@ stage: Modified - name: Modified5054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3786\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3786\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3786\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195769,7 +195769,7 @@ stage: Modified - name: Modified5055 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3787\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195791,7 +195791,7 @@ stage: Modified - name: Modified5056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3787\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3787\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3787\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195799,7 +195799,7 @@ stage: Modified - name: Modified5057 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3788\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195821,7 +195821,7 @@ stage: Modified - name: Modified5058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3788\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3788\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3788\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -195830,7 +195830,7 @@ stage: Modified - name: Modified5059 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3789\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195852,7 +195852,7 @@ stage: Modified - name: Modified5060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3789\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3789\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3789\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -195861,7 +195861,7 @@ stage: Modified - name: Modified5061 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3790\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195883,7 +195883,7 @@ stage: Modified - name: Modified5062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3790\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3790\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3790\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195891,7 +195891,7 @@ stage: Modified - name: Modified5063 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3791\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -195913,7 +195913,7 @@ stage: Modified - name: Modified5064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3791\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3791\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3791\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195921,7 +195921,7 @@ stage: Modified - name: Modified5065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key", "arch": "[x64]", "timestamp": 1606816974, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -195929,7 +195929,7 @@ stage: Modified - name: Modified5066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -195938,7 +195938,7 @@ stage: Modified - name: Modified5067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key", "arch": "[x64]", "timestamp": 1606816974, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -195946,7 +195946,7 @@ stage: Modified - name: Modified5068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -195955,7 +195955,7 @@ stage: Modified - name: Modified5069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key", "arch": "[x64]", "timestamp": 1606816974, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -195963,7 +195963,7 @@ stage: Modified - name: Modified5070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195971,7 +195971,7 @@ stage: Modified - name: Modified5071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key", "arch": "[x64]", "timestamp": 1606816974, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -195979,7 +195979,7 @@ stage: Modified - name: Modified5072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -195987,7 +195987,7 @@ stage: Modified - name: Modified5073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key", "arch": "[x64]", "timestamp": 1606816974, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -195995,7 +195995,7 @@ stage: Modified - name: Modified5074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -196004,7 +196004,7 @@ stage: Modified - name: Modified5075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key", "arch": "[x64]", "timestamp": 1606816974, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -196012,7 +196012,7 @@ stage: Modified - name: Modified5076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -196021,7 +196021,7 @@ stage: Modified - name: Modified5077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key", "arch": "[x64]", "timestamp": 1606816974, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -196029,7 +196029,7 @@ stage: Modified - name: Modified5078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196037,7 +196037,7 @@ stage: Modified - name: Modified5079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770056,"checksum":"57a7d59dedad3e79bda2ce3af58bea65ab497fc7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key", "arch": "[x64]", "timestamp": 1606816974, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -196045,7 +196045,7 @@ stage: Modified - name: Modified5080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196053,7 +196053,7 @@ stage: Modified - name: Modified5081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3800\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3800\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3800\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -196062,7 +196062,7 @@ stage: Modified - name: Modified5082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3801\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3801\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3801\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -196071,7 +196071,7 @@ stage: Modified - name: Modified5083 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3802\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3802\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3802\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196079,7 +196079,7 @@ stage: Modified - name: Modified5084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3803\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3803\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3803\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196087,7 +196087,7 @@ stage: Modified - name: Modified5085 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3804\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3804\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3804\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -196096,7 +196096,7 @@ stage: Modified - name: Modified5086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3805\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3805\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3805\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -196105,7 +196105,7 @@ stage: Modified - name: Modified5087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3806\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3806\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3806\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196113,7 +196113,7 @@ stage: Modified - name: Modified5088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3807\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3807\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3807\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196121,7 +196121,7 @@ stage: Modified - name: Modified5089 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196142,7 +196142,7 @@ stage: Modified - name: Modified5090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -196151,7 +196151,7 @@ stage: Modified - name: Modified5091 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196172,7 +196172,7 @@ stage: Modified - name: Modified5092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -196181,7 +196181,7 @@ stage: Modified - name: Modified5093 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196202,7 +196202,7 @@ stage: Modified - name: Modified5094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196210,7 +196210,7 @@ stage: Modified - name: Modified5095 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196231,7 +196231,7 @@ stage: Modified - name: Modified5096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196239,7 +196239,7 @@ stage: Modified - name: Modified5097 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816974,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196260,7 +196260,7 @@ stage: Modified - name: Modified5098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816974,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816974, "attributes": @@ -196269,7 +196269,7 @@ stage: Modified - name: Modified5099 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196290,7 +196290,7 @@ stage: Modified - name: Modified5100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196299,7 +196299,7 @@ stage: Modified - name: Modified5101 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196320,7 +196320,7 @@ stage: Modified - name: Modified5102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196328,7 +196328,7 @@ stage: Modified - name: Modified5103 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196349,7 +196349,7 @@ stage: Modified - name: Modified5104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196357,7 +196357,7 @@ stage: Modified - name: Modified5105 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3816\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196378,7 +196378,7 @@ stage: Modified - name: Modified5106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3816\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3816\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3816\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196387,7 +196387,7 @@ stage: Modified - name: Modified5107 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3817\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196408,7 +196408,7 @@ stage: Modified - name: Modified5108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3817\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3817\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3817\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196417,7 +196417,7 @@ stage: Modified - name: Modified5109 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3818\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196438,7 +196438,7 @@ stage: Modified - name: Modified5110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3818\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3818\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3818\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196446,7 +196446,7 @@ stage: Modified - name: Modified5111 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3819\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196467,7 +196467,7 @@ stage: Modified - name: Modified5112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3819\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3819\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3819\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196475,7 +196475,7 @@ stage: Modified - name: Modified5113 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3820\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196496,7 +196496,7 @@ stage: Modified - name: Modified5114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3820\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3820\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3820\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196505,7 +196505,7 @@ stage: Modified - name: Modified5115 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3821\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196526,7 +196526,7 @@ stage: Modified - name: Modified5116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3821\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3821\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3821\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196535,7 +196535,7 @@ stage: Modified - name: Modified5117 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3822\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196556,7 +196556,7 @@ stage: Modified - name: Modified5118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3822\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3822\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3822\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196564,7 +196564,7 @@ stage: Modified - name: Modified5119 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3823\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196585,7 +196585,7 @@ stage: Modified - name: Modified5120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3823\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3823\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3823\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196593,14 +196593,14 @@ stage: Modified - name: Modified5121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key", "arch": "[x64]", "timestamp": 1606816975, "attributes": {"type": "registry_key", "mtime": 1606770057, "checksum": "cefbd6ddd542f2eb08919e082b2236b10db775bd"}}' stage: Modified - name: Modified5122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196609,14 +196609,14 @@ stage: Modified - name: Modified5123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key", "arch": "[x64]", "timestamp": 1606816975, "attributes": {"type": "registry_key", "mtime": 1606770057, "checksum": "cefbd6ddd542f2eb08919e082b2236b10db775bd"}}' stage: Modified - name: Modified5124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196625,14 +196625,14 @@ stage: Modified - name: Modified5125 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key", "arch": "[x64]", "timestamp": 1606816975, "attributes": {"type": "registry_key", "mtime": 1606770057, "checksum": "cefbd6ddd542f2eb08919e082b2236b10db775bd"}}' stage: Modified - name: Modified5126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196640,14 +196640,14 @@ stage: Modified - name: Modified5127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key", "arch": "[x64]", "timestamp": 1606816975, "attributes": {"type": "registry_key", "mtime": 1606770057, "checksum": "cefbd6ddd542f2eb08919e082b2236b10db775bd"}}' stage: Modified - name: Modified5128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196655,14 +196655,14 @@ stage: Modified - name: Modified5129 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key", "arch": "[x64]", "timestamp": 1606816975, "attributes": {"type": "registry_key", "mtime": 1606770057, "checksum": "cefbd6ddd542f2eb08919e082b2236b10db775bd"}}' stage: Modified - name: Modified5130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196671,14 +196671,14 @@ stage: Modified - name: Modified5131 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key", "arch": "[x64]", "timestamp": 1606816975, "attributes": {"type": "registry_key", "mtime": 1606770057, "checksum": "cefbd6ddd542f2eb08919e082b2236b10db775bd"}}' stage: Modified - name: Modified5132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196687,14 +196687,14 @@ stage: Modified - name: Modified5133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key", "arch": "[x64]", "timestamp": 1606816975, "attributes": {"type": "registry_key", "mtime": 1606770057, "checksum": "cefbd6ddd542f2eb08919e082b2236b10db775bd"}}' stage: Modified - name: Modified5134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196702,14 +196702,14 @@ stage: Modified - name: Modified5135 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","mtime":1606770057,"checksum":"cefbd6ddd542f2eb08919e082b2236b10db775bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key", "arch": "[x64]", "timestamp": 1606816975, "attributes": {"type": "registry_key", "mtime": 1606770057, "checksum": "cefbd6ddd542f2eb08919e082b2236b10db775bd"}}' stage: Modified - name: Modified5136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196717,7 +196717,7 @@ stage: Modified - name: Modified5137 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3832\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3832\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3832\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196726,7 +196726,7 @@ stage: Modified - name: Modified5138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3833\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3833\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3833\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196735,7 +196735,7 @@ stage: Modified - name: Modified5139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3834\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3834\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3834\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196743,7 +196743,7 @@ stage: Modified - name: Modified5140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3835\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3835\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3835\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196751,7 +196751,7 @@ stage: Modified - name: Modified5141 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3836\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3836\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3836\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196760,7 +196760,7 @@ stage: Modified - name: Modified5142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3837\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3837\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3837\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196769,7 +196769,7 @@ stage: Modified - name: Modified5143 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3838\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3838\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3838\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196777,7 +196777,7 @@ stage: Modified - name: Modified5144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3839\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3839\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"96bb0b47580142b700c7cf6f28fb73d008cbd8ae"},"changed_attributes":["sha256"],"old_attributes":{"type":"registry_value","hash_sha256":"279b8a60f444fa8b6275687ce7e44363d97f72f88e4a3285baf0d9ed812e4061","checksum":"6bd81aa5aaf2f554fd22a29f9ab2d70e423592a5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3839\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "hash_sha256": "b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e", @@ -196785,7 +196785,7 @@ stage: Modified - name: Modified5145 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196808,7 +196808,7 @@ stage: Modified - name: Modified5146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196816,7 +196816,7 @@ stage: Modified - name: Modified5147 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196839,7 +196839,7 @@ stage: Modified - name: Modified5148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196847,7 +196847,7 @@ stage: Modified - name: Modified5149 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196870,14 +196870,14 @@ stage: Modified - name: Modified5150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5151 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196900,14 +196900,14 @@ stage: Modified - name: Modified5152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5153 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196930,7 +196930,7 @@ stage: Modified - name: Modified5154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196938,7 +196938,7 @@ stage: Modified - name: Modified5155 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196961,7 +196961,7 @@ stage: Modified - name: Modified5156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -196969,7 +196969,7 @@ stage: Modified - name: Modified5157 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -196992,14 +196992,14 @@ stage: Modified - name: Modified5158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5159 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197022,14 +197022,14 @@ stage: Modified - name: Modified5160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5161 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3848\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197052,7 +197052,7 @@ stage: Modified - name: Modified5162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3848\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3848\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3848\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -197060,7 +197060,7 @@ stage: Modified - name: Modified5163 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3849\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197083,7 +197083,7 @@ stage: Modified - name: Modified5164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3849\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3849\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3849\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": @@ -197091,7 +197091,7 @@ stage: Modified - name: Modified5165 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3850\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197114,14 +197114,14 @@ stage: Modified - name: Modified5166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3850\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3850\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3850\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5167 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3851\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816975,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197144,14 +197144,14 @@ stage: Modified - name: Modified5168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3851\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3851\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816975,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3851\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816975, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5169 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3852\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197174,7 +197174,7 @@ stage: Modified - name: Modified5170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3852\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3852\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3852\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197182,7 +197182,7 @@ stage: Modified - name: Modified5171 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3853\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197205,7 +197205,7 @@ stage: Modified - name: Modified5172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3853\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3853\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3853\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197213,7 +197213,7 @@ stage: Modified - name: Modified5173 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3854\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197236,14 +197236,14 @@ stage: Modified - name: Modified5174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3854\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3854\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3854\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5175 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3855\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197266,14 +197266,14 @@ stage: Modified - name: Modified5176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3855\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3855\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3855\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5177 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197282,7 +197282,7 @@ stage: Modified - name: Modified5178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197290,7 +197290,7 @@ stage: Modified - name: Modified5179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197299,7 +197299,7 @@ stage: Modified - name: Modified5180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197307,7 +197307,7 @@ stage: Modified - name: Modified5181 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197316,14 +197316,14 @@ stage: Modified - name: Modified5182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5183 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197332,14 +197332,14 @@ stage: Modified - name: Modified5184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197348,7 +197348,7 @@ stage: Modified - name: Modified5186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197356,7 +197356,7 @@ stage: Modified - name: Modified5187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197365,7 +197365,7 @@ stage: Modified - name: Modified5188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197373,7 +197373,7 @@ stage: Modified - name: Modified5189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197382,14 +197382,14 @@ stage: Modified - name: Modified5190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770057,"checksum":"99843b00ec7c919853996f207b4bc6bb4d0066ca"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197398,14 +197398,14 @@ stage: Modified - name: Modified5192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197414,7 +197414,7 @@ stage: Modified - name: Modified5194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3864\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197422,7 +197422,7 @@ stage: Modified - name: Modified5195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197431,7 +197431,7 @@ stage: Modified - name: Modified5196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3865\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197439,7 +197439,7 @@ stage: Modified - name: Modified5197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197448,14 +197448,14 @@ stage: Modified - name: Modified5198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3866\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197464,14 +197464,14 @@ stage: Modified - name: Modified5200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3867\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197480,7 +197480,7 @@ stage: Modified - name: Modified5202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3868\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197488,7 +197488,7 @@ stage: Modified - name: Modified5203 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197497,7 +197497,7 @@ stage: Modified - name: Modified5204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3869\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197505,7 +197505,7 @@ stage: Modified - name: Modified5205 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197514,14 +197514,14 @@ stage: Modified - name: Modified5206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3870\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -197530,14 +197530,14 @@ stage: Modified - name: Modified5208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3871\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5209 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197559,7 +197559,7 @@ stage: Modified - name: Modified5210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197567,7 +197567,7 @@ stage: Modified - name: Modified5211 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197589,7 +197589,7 @@ stage: Modified - name: Modified5212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197597,7 +197597,7 @@ stage: Modified - name: Modified5213 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197619,14 +197619,14 @@ stage: Modified - name: Modified5214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5215 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197648,14 +197648,14 @@ stage: Modified - name: Modified5216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5217 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197677,7 +197677,7 @@ stage: Modified - name: Modified5218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197685,7 +197685,7 @@ stage: Modified - name: Modified5219 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197707,7 +197707,7 @@ stage: Modified - name: Modified5220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197715,7 +197715,7 @@ stage: Modified - name: Modified5221 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197737,14 +197737,14 @@ stage: Modified - name: Modified5222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5223 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197766,14 +197766,14 @@ stage: Modified - name: Modified5224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5225 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3880\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197795,7 +197795,7 @@ stage: Modified - name: Modified5226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3880\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3880\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3880\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197803,7 +197803,7 @@ stage: Modified - name: Modified5227 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3881\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197825,7 +197825,7 @@ stage: Modified - name: Modified5228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3881\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3881\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3881\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197833,7 +197833,7 @@ stage: Modified - name: Modified5229 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3882\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197855,14 +197855,14 @@ stage: Modified - name: Modified5230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3882\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3882\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3882\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5231 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3883\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197884,14 +197884,14 @@ stage: Modified - name: Modified5232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3883\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3883\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3883\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5233 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3884\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197913,7 +197913,7 @@ stage: Modified - name: Modified5234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3884\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3884\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3884\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197921,7 +197921,7 @@ stage: Modified - name: Modified5235 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3885\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197943,7 +197943,7 @@ stage: Modified - name: Modified5236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3885\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3885\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3885\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -197951,7 +197951,7 @@ stage: Modified - name: Modified5237 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3886\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -197973,14 +197973,14 @@ stage: Modified - name: Modified5238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3886\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3886\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3886\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5239 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3887\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198002,14 +198002,14 @@ stage: Modified - name: Modified5240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3887\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3887\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3887\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198017,7 +198017,7 @@ stage: Modified - name: Modified5242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -198025,7 +198025,7 @@ stage: Modified - name: Modified5243 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816976,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key", "arch": "[x64]", "timestamp": 1606816976, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198033,7 +198033,7 @@ stage: Modified - name: Modified5244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816976,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816976, "attributes": @@ -198041,7 +198041,7 @@ stage: Modified - name: Modified5245 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198049,14 +198049,14 @@ stage: Modified - name: Modified5246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198064,14 +198064,14 @@ stage: Modified - name: Modified5248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5249 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198079,7 +198079,7 @@ stage: Modified - name: Modified5250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198087,7 +198087,7 @@ stage: Modified - name: Modified5251 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198095,7 +198095,7 @@ stage: Modified - name: Modified5252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198103,7 +198103,7 @@ stage: Modified - name: Modified5253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198111,14 +198111,14 @@ stage: Modified - name: Modified5254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5255 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770058,"checksum":"b41eb924aba8abf11817886c817cd82e0161822a"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198126,14 +198126,14 @@ stage: Modified - name: Modified5256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5257 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198141,7 +198141,7 @@ stage: Modified - name: Modified5258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3896\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198149,7 +198149,7 @@ stage: Modified - name: Modified5259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198157,7 +198157,7 @@ stage: Modified - name: Modified5260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3897\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198165,7 +198165,7 @@ stage: Modified - name: Modified5261 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198173,14 +198173,14 @@ stage: Modified - name: Modified5262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3898\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5263 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198188,14 +198188,14 @@ stage: Modified - name: Modified5264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3899\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198203,7 +198203,7 @@ stage: Modified - name: Modified5266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3900\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198211,7 +198211,7 @@ stage: Modified - name: Modified5267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198219,7 +198219,7 @@ stage: Modified - name: Modified5268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3901\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198227,7 +198227,7 @@ stage: Modified - name: Modified5269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198235,14 +198235,14 @@ stage: Modified - name: Modified5270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3902\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -198250,14 +198250,14 @@ stage: Modified - name: Modified5272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3903\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5273 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198279,7 +198279,7 @@ stage: Modified - name: Modified5274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198287,7 +198287,7 @@ stage: Modified - name: Modified5275 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198309,7 +198309,7 @@ stage: Modified - name: Modified5276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198317,7 +198317,7 @@ stage: Modified - name: Modified5277 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198339,14 +198339,14 @@ stage: Modified - name: Modified5278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5279 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198368,14 +198368,14 @@ stage: Modified - name: Modified5280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5281 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198397,7 +198397,7 @@ stage: Modified - name: Modified5282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198405,7 +198405,7 @@ stage: Modified - name: Modified5283 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198427,7 +198427,7 @@ stage: Modified - name: Modified5284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198435,7 +198435,7 @@ stage: Modified - name: Modified5285 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198457,14 +198457,14 @@ stage: Modified - name: Modified5286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5287 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198486,14 +198486,14 @@ stage: Modified - name: Modified5288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5289 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3912\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198515,7 +198515,7 @@ stage: Modified - name: Modified5290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3912\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3912\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3912\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198523,7 +198523,7 @@ stage: Modified - name: Modified5291 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3913\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198545,7 +198545,7 @@ stage: Modified - name: Modified5292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3913\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3913\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3913\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198553,7 +198553,7 @@ stage: Modified - name: Modified5293 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3914\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198575,14 +198575,14 @@ stage: Modified - name: Modified5294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3914\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3914\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3914\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5295 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3915\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198604,14 +198604,14 @@ stage: Modified - name: Modified5296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3915\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3915\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3915\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5297 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3916\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198633,7 +198633,7 @@ stage: Modified - name: Modified5298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3916\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3916\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3916\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198641,7 +198641,7 @@ stage: Modified - name: Modified5299 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3917\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198663,7 +198663,7 @@ stage: Modified - name: Modified5300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3917\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3917\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3917\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198671,7 +198671,7 @@ stage: Modified - name: Modified5301 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3918\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198693,14 +198693,14 @@ stage: Modified - name: Modified5302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3918\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3918\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3918\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5303 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3919\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198722,14 +198722,14 @@ stage: Modified - name: Modified5304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3919\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3919\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3919\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -198737,7 +198737,7 @@ stage: Modified - name: Modified5306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198745,7 +198745,7 @@ stage: Modified - name: Modified5307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816977,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key", "arch": "[x64]", "timestamp": 1606816977, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -198753,7 +198753,7 @@ stage: Modified - name: Modified5308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816977,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816977, "attributes": @@ -198761,7 +198761,7 @@ stage: Modified - name: Modified5309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key", "arch": "[x64]", "timestamp": 1606816978, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -198769,14 +198769,14 @@ stage: Modified - name: Modified5310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key", "arch": "[x64]", "timestamp": 1606816978, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -198784,14 +198784,14 @@ stage: Modified - name: Modified5312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key", "arch": "[x64]", "timestamp": 1606816978, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -198799,7 +198799,7 @@ stage: Modified - name: Modified5314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -198807,7 +198807,7 @@ stage: Modified - name: Modified5315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key", "arch": "[x64]", "timestamp": 1606816978, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -198815,7 +198815,7 @@ stage: Modified - name: Modified5316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -198823,7 +198823,7 @@ stage: Modified - name: Modified5317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key", "arch": "[x64]", "timestamp": 1606816978, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -198831,14 +198831,14 @@ stage: Modified - name: Modified5318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770058,"checksum":"80bd0e61857cfda9aa29a21ba65d7ff94d2b8c6f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key", "arch": "[x64]", "timestamp": 1606816978, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -198846,14 +198846,14 @@ stage: Modified - name: Modified5320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3928\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3928\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3928\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -198861,7 +198861,7 @@ stage: Modified - name: Modified5322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3929\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3929\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3929\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -198869,21 +198869,21 @@ stage: Modified - name: Modified5323 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3930\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3930\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3930\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3931\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3931\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3931\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5325 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3932\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3932\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3932\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -198891,7 +198891,7 @@ stage: Modified - name: Modified5326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3933\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3933\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3933\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -198899,21 +198899,21 @@ stage: Modified - name: Modified5327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3934\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3934\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3934\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3935\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3935\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3935\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5329 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198934,7 +198934,7 @@ stage: Modified - name: Modified5330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -198942,7 +198942,7 @@ stage: Modified - name: Modified5331 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198963,7 +198963,7 @@ stage: Modified - name: Modified5332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -198971,7 +198971,7 @@ stage: Modified - name: Modified5333 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -198992,14 +198992,14 @@ stage: Modified - name: Modified5334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5335 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199020,14 +199020,14 @@ stage: Modified - name: Modified5336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5337 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199048,7 +199048,7 @@ stage: Modified - name: Modified5338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -199056,7 +199056,7 @@ stage: Modified - name: Modified5339 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199077,7 +199077,7 @@ stage: Modified - name: Modified5340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -199085,7 +199085,7 @@ stage: Modified - name: Modified5341 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199106,14 +199106,14 @@ stage: Modified - name: Modified5342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5343 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199134,14 +199134,14 @@ stage: Modified - name: Modified5344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5345 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3944\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199162,7 +199162,7 @@ stage: Modified - name: Modified5346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3944\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3944\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3944\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -199170,7 +199170,7 @@ stage: Modified - name: Modified5347 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3945\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199191,7 +199191,7 @@ stage: Modified - name: Modified5348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3945\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3945\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3945\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -199199,7 +199199,7 @@ stage: Modified - name: Modified5349 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3946\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199220,14 +199220,14 @@ stage: Modified - name: Modified5350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3946\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3946\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3946\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5351 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3947\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199248,14 +199248,14 @@ stage: Modified - name: Modified5352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3947\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3947\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3947\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5353 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3948\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199276,7 +199276,7 @@ stage: Modified - name: Modified5354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3948\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3948\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3948\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -199284,7 +199284,7 @@ stage: Modified - name: Modified5355 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3949\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199305,7 +199305,7 @@ stage: Modified - name: Modified5356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3949\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3949\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3949\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -199313,7 +199313,7 @@ stage: Modified - name: Modified5357 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3950\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199334,14 +199334,14 @@ stage: Modified - name: Modified5358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3950\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3950\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3950\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5359 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3951\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199362,21 +199362,21 @@ stage: Modified - name: Modified5360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3951\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3951\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3951\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816978,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key", "arch": "[x64]", "timestamp": 1606816978, "attributes": {"type": "registry_key", "mtime": 1606770059, "checksum": "a02158b59c183b81d4041abb2f34ea47c9b557ca"}}' stage: Modified - name: Modified5362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816978,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816978, "attributes": @@ -199384,14 +199384,14 @@ stage: Modified - name: Modified5363 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key", "arch": "[x64]", "timestamp": 1606816979, "attributes": {"type": "registry_key", "mtime": 1606770059, "checksum": "a02158b59c183b81d4041abb2f34ea47c9b557ca"}}' stage: Modified - name: Modified5364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": @@ -199399,42 +199399,42 @@ stage: Modified - name: Modified5365 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key", "arch": "[x64]", "timestamp": 1606816979, "attributes": {"type": "registry_key", "mtime": 1606770059, "checksum": "a02158b59c183b81d4041abb2f34ea47c9b557ca"}}' stage: Modified - name: Modified5366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key", "arch": "[x64]", "timestamp": 1606816979, "attributes": {"type": "registry_key", "mtime": 1606770059, "checksum": "a02158b59c183b81d4041abb2f34ea47c9b557ca"}}' stage: Modified - name: Modified5368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5369 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key", "arch": "[x64]", "timestamp": 1606816979, "attributes": {"type": "registry_key", "mtime": 1606770059, "checksum": "a02158b59c183b81d4041abb2f34ea47c9b557ca"}}' stage: Modified - name: Modified5370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": @@ -199442,14 +199442,14 @@ stage: Modified - name: Modified5371 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key", "arch": "[x64]", "timestamp": 1606816979, "attributes": {"type": "registry_key", "mtime": 1606770059, "checksum": "a02158b59c183b81d4041abb2f34ea47c9b557ca"}}' stage: Modified - name: Modified5372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": @@ -199457,35 +199457,35 @@ stage: Modified - name: Modified5373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key", "arch": "[x64]", "timestamp": 1606816979, "attributes": {"type": "registry_key", "mtime": 1606770059, "checksum": "a02158b59c183b81d4041abb2f34ea47c9b557ca"}}' stage: Modified - name: Modified5374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5375 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","mtime":1606770059,"checksum":"a02158b59c183b81d4041abb2f34ea47c9b557ca"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key", "arch": "[x64]", "timestamp": 1606816979, "attributes": {"type": "registry_key", "mtime": 1606770059, "checksum": "a02158b59c183b81d4041abb2f34ea47c9b557ca"}}' stage: Modified - name: Modified5376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5377 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3960\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3960\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3960\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": @@ -199493,7 +199493,7 @@ stage: Modified - name: Modified5378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3961\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3961\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3961\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": @@ -199501,21 +199501,21 @@ stage: Modified - name: Modified5379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3962\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3962\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3962\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3963\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3963\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","value_type":"REG_SZ","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3963\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": {"type": "registry_value", "value_type": "REG_SZ", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5381 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3964\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3964\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n","tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3964\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": @@ -199523,7 +199523,7 @@ stage: Modified - name: Modified5382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3965\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3965\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"content_changes":"< added\n---\n> modified\n"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3965\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": @@ -199531,21 +199531,21 @@ stage: Modified - name: Modified5383 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3966\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3966\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3966\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3967\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3967\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","value_name":"value_name","timestamp":1606816979,"attributes":{"type":"registry_value","size":9,"checksum":"b87c2328247b7e558d6e0e33d94afe0a60731a40"},"changed_attributes":["size"],"old_attributes":{"type":"registry_value","size":6,"checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3967\\reg_key", "arch": "[x64]", "value_name": "value_name", "timestamp": 1606816979, "attributes": {"type": "registry_value", "size": 9, "checksum": "b87c2328247b7e558d6e0e33d94afe0a60731a40"}}' stage: Modified - name: Modified5385 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3968\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3968\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199568,7 +199568,7 @@ stage: Modified - name: Modified5386 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3969\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3969\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199591,7 +199591,7 @@ stage: Modified - name: Modified5387 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3970\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3970\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199614,7 +199614,7 @@ stage: Modified - name: Modified5388 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3971\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3971\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199637,7 +199637,7 @@ stage: Modified - name: Modified5389 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3972\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3972\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199660,7 +199660,7 @@ stage: Modified - name: Modified5390 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3973\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3973\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199683,7 +199683,7 @@ stage: Modified - name: Modified5391 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3974\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3974\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199706,7 +199706,7 @@ stage: Modified - name: Modified5392 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3975\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3975\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199729,7 +199729,7 @@ stage: Modified - name: Modified5393 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3976\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3976\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199752,7 +199752,7 @@ stage: Modified - name: Modified5394 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3977\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3977\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199775,7 +199775,7 @@ stage: Modified - name: Modified5395 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3978\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3978\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199798,7 +199798,7 @@ stage: Modified - name: Modified5396 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3979\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3979\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199821,7 +199821,7 @@ stage: Modified - name: Modified5397 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3980\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3980\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199844,7 +199844,7 @@ stage: Modified - name: Modified5398 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3981\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3981\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816979,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199867,7 +199867,7 @@ stage: Modified - name: Modified5399 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3982\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3982\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199890,7 +199890,7 @@ stage: Modified - name: Modified5400 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3983\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3983\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -199913,7 +199913,7 @@ stage: Modified - name: Modified5401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -199922,7 +199922,7 @@ stage: Modified - name: Modified5402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -199931,7 +199931,7 @@ stage: Modified - name: Modified5403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -199940,7 +199940,7 @@ stage: Modified - name: Modified5404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -199949,7 +199949,7 @@ stage: Modified - name: Modified5405 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -199958,7 +199958,7 @@ stage: Modified - name: Modified5406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -199967,7 +199967,7 @@ stage: Modified - name: Modified5407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770059,"checksum":"cac5c6057015e942cb3ffb1298517fa1e493a7fd"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -199976,7 +199976,7 @@ stage: Modified - name: Modified5408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770060,"checksum":"75c27560f24fc9448cc23d7afebf88a26acf0d83"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770060,"checksum":"75c27560f24fc9448cc23d7afebf88a26acf0d83"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -199985,7 +199985,7 @@ stage: Modified - name: Modified5409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3992\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3992\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3992\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -199994,7 +199994,7 @@ stage: Modified - name: Modified5410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3993\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3993\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3993\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200003,7 +200003,7 @@ stage: Modified - name: Modified5411 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3994\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3994\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3994\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200012,7 +200012,7 @@ stage: Modified - name: Modified5412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3995\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3995\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3995\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200021,7 +200021,7 @@ stage: Modified - name: Modified5413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3996\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3996\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3996\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200030,7 +200030,7 @@ stage: Modified - name: Modified5414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3997\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3997\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3997\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200039,7 +200039,7 @@ stage: Modified - name: Modified5415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3998\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3998\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3998\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200048,7 +200048,7 @@ stage: Modified - name: Modified5416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3999\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3999\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0b0adffc8d81ddb28f29b726858f29d54665a053"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3999\\reg_key", "arch": "[x64]", "timestamp": 1606816980, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200057,7 +200057,7 @@ stage: Modified - name: Modified5417 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4000\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4000\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200079,7 +200079,7 @@ stage: Modified - name: Modified5418 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4001\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4001\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200101,7 +200101,7 @@ stage: Modified - name: Modified5419 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4002\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4002\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200123,7 +200123,7 @@ stage: Modified - name: Modified5420 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4003\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4003\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200145,7 +200145,7 @@ stage: Modified - name: Modified5421 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4004\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4004\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200167,7 +200167,7 @@ stage: Modified - name: Modified5422 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4005\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4005\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200189,7 +200189,7 @@ stage: Modified - name: Modified5423 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4006\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4006\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200211,7 +200211,7 @@ stage: Modified - name: Modified5424 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4007\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4007\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200233,7 +200233,7 @@ stage: Modified - name: Modified5425 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4008\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4008\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200255,7 +200255,7 @@ stage: Modified - name: Modified5426 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4009\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4009\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200277,7 +200277,7 @@ stage: Modified - name: Modified5427 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4010\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4010\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200299,7 +200299,7 @@ stage: Modified - name: Modified5428 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4011\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4011\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200321,7 +200321,7 @@ stage: Modified - name: Modified5429 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4012\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4012\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200343,7 +200343,7 @@ stage: Modified - name: Modified5430 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4013\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4013\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816980,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200365,7 +200365,7 @@ stage: Modified - name: Modified5431 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4014\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816981,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4014\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816981,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200387,7 +200387,7 @@ stage: Modified - name: Modified5432 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4015\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816981,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4015\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816981,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200409,7 +200409,7 @@ stage: Modified - name: Modified5433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816981,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816981,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016\\reg_key", "arch": "[x64]", "timestamp": 1606816981, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200417,7 +200417,7 @@ stage: Modified - name: Modified5434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816981,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816981,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017\\reg_key", "arch": "[x64]", "timestamp": 1606816981, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200425,7 +200425,7 @@ stage: Modified - name: Modified5435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816982,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816982,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018\\reg_key", "arch": "[x64]", "timestamp": 1606816982, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200433,7 +200433,7 @@ stage: Modified - name: Modified5436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816982,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816982,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019\\reg_key", "arch": "[x64]", "timestamp": 1606816982, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200441,7 +200441,7 @@ stage: Modified - name: Modified5437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816982,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816982,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020\\reg_key", "arch": "[x64]", "timestamp": 1606816982, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200449,7 +200449,7 @@ stage: Modified - name: Modified5438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816983,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816983,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021\\reg_key", "arch": "[x64]", "timestamp": 1606816983, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200457,7 +200457,7 @@ stage: Modified - name: Modified5439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816984,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816984,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022\\reg_key", "arch": "[x64]", "timestamp": 1606816984, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200465,7 +200465,7 @@ stage: Modified - name: Modified5440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816984,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816984,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606770060,"checksum":"a2ce166dcb722407ab668189bb1a38117037d132"},"changed_attributes":["uid","user_name","mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023\\reg_key", "arch": "[x64]", "timestamp": 1606816984, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200473,7 +200473,7 @@ stage: Modified - name: Modified5441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4024\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816984,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4024\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816984,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4024\\reg_key", "arch": "[x64]", "timestamp": 1606816984, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200481,7 +200481,7 @@ stage: Modified - name: Modified5442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4025\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816985,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4025\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816985,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4025\\reg_key", "arch": "[x64]", "timestamp": 1606816985, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200489,7 +200489,7 @@ stage: Modified - name: Modified5443 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4026\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816987,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4026\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816987,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4026\\reg_key", "arch": "[x64]", "timestamp": 1606816987, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200497,7 +200497,7 @@ stage: Modified - name: Modified5444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4027\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816987,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4027\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816987,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4027\\reg_key", "arch": "[x64]", "timestamp": 1606816987, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200505,7 +200505,7 @@ stage: Modified - name: Modified5445 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4028\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816987,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4028\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816987,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4028\\reg_key", "arch": "[x64]", "timestamp": 1606816987, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200513,7 +200513,7 @@ stage: Modified - name: Modified5446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4029\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816988,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4029\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816988,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4029\\reg_key", "arch": "[x64]", "timestamp": 1606816988, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200521,7 +200521,7 @@ stage: Modified - name: Modified5447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4030\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816990,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4030\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816990,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4030\\reg_key", "arch": "[x64]", "timestamp": 1606816990, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200529,7 +200529,7 @@ stage: Modified - name: Modified5448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4031\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816990,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4031\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816990,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"changed_attributes":["uid","user_name"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","checksum":"2fa6dc61bd73c86cf251ea1c97953b3a29dbd11c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4031\\reg_key", "arch": "[x64]", "timestamp": 1606816990, "attributes": {"type": "registry_key", "uid": "S-1-5-21-3527455827-79240758-596275861-1001", "user_name": "jmv74211", @@ -200537,7 +200537,7 @@ stage: Modified - name: Modified5449 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4032\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816990,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4032\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816990,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200559,7 +200559,7 @@ stage: Modified - name: Modified5450 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4033\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816991,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4033\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816991,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200581,7 +200581,7 @@ stage: Modified - name: Modified5451 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4034\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816993,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4034\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816993,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200603,7 +200603,7 @@ stage: Modified - name: Modified5452 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4035\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816993,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4035\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816993,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200625,7 +200625,7 @@ stage: Modified - name: Modified5453 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4036\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816993,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4036\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816993,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200647,7 +200647,7 @@ stage: Modified - name: Modified5454 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4037\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816993,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4037\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816993,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200669,7 +200669,7 @@ stage: Modified - name: Modified5455 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4038\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816994,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4038\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816994,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200691,7 +200691,7 @@ stage: Modified - name: Modified5456 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4039\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816994,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4039\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816994,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200713,7 +200713,7 @@ stage: Modified - name: Modified5457 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4040\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816994,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4040\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816994,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200735,7 +200735,7 @@ stage: Modified - name: Modified5458 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4041\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816995,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4041\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816995,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200757,7 +200757,7 @@ stage: Modified - name: Modified5459 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4042\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816995,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4042\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816995,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200779,7 +200779,7 @@ stage: Modified - name: Modified5460 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4043\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816995,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4043\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816995,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200801,7 +200801,7 @@ stage: Modified - name: Modified5461 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4044\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816995,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4044\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816995,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200823,7 +200823,7 @@ stage: Modified - name: Modified5462 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4045\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816996,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4045\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816996,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200845,7 +200845,7 @@ stage: Modified - name: Modified5463 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4046\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816996,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4046\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816996,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200867,7 +200867,7 @@ stage: Modified - name: Modified5464 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4047\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816996,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4047\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816996,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200889,7 +200889,7 @@ stage: Modified - name: Modified5465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816996,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770060,"checksum":"664e18546bd88025513dc04e6d5e47922c60866f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816996,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770060,"checksum":"664e18546bd88025513dc04e6d5e47922c60866f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048\\reg_key", "arch": "[x64]", "timestamp": 1606816996, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -200897,7 +200897,7 @@ stage: Modified - name: Modified5466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816997,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770060,"checksum":"664e18546bd88025513dc04e6d5e47922c60866f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816997,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770060,"checksum":"664e18546bd88025513dc04e6d5e47922c60866f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049\\reg_key", "arch": "[x64]", "timestamp": 1606816997, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -200905,7 +200905,7 @@ stage: Modified - name: Modified5467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816998,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770060,"checksum":"664e18546bd88025513dc04e6d5e47922c60866f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816998,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770060,"checksum":"664e18546bd88025513dc04e6d5e47922c60866f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050\\reg_key", "arch": "[x64]", "timestamp": 1606816998, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -200913,7 +200913,7 @@ stage: Modified - name: Modified5468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816998,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770061,"checksum":"f4b110505efc174d905516b10bae137ba09a5597"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816998,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770061,"checksum":"f4b110505efc174d905516b10bae137ba09a5597"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051\\reg_key", "arch": "[x64]", "timestamp": 1606816998, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -200921,7 +200921,7 @@ stage: Modified - name: Modified5469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816998,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770061,"checksum":"f4b110505efc174d905516b10bae137ba09a5597"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816998,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770061,"checksum":"f4b110505efc174d905516b10bae137ba09a5597"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052\\reg_key", "arch": "[x64]", "timestamp": 1606816998, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -200929,7 +200929,7 @@ stage: Modified - name: Modified5470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816998,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770061,"checksum":"f4b110505efc174d905516b10bae137ba09a5597"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816998,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770061,"checksum":"f4b110505efc174d905516b10bae137ba09a5597"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053\\reg_key", "arch": "[x64]", "timestamp": 1606816998, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -200937,7 +200937,7 @@ stage: Modified - name: Modified5471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816999,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770061,"checksum":"f4b110505efc174d905516b10bae137ba09a5597"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816999,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770061,"checksum":"f4b110505efc174d905516b10bae137ba09a5597"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054\\reg_key", "arch": "[x64]", "timestamp": 1606816999, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -200945,7 +200945,7 @@ stage: Modified - name: Modified5472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816999,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770061,"checksum":"f4b110505efc174d905516b10bae137ba09a5597"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606816999,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606770061,"checksum":"f4b110505efc174d905516b10bae137ba09a5597"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055\\reg_key", "arch": "[x64]", "timestamp": 1606816999, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -200953,7 +200953,7 @@ stage: Modified - name: Modified5473 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4064\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817001,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4064\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817001,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200974,7 +200974,7 @@ stage: Modified - name: Modified5474 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4065\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817002,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4065\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817002,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -200995,7 +200995,7 @@ stage: Modified - name: Modified5475 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4066\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817003,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4066\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817003,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201016,7 +201016,7 @@ stage: Modified - name: Modified5476 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4067\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817003,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4067\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817003,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201037,7 +201037,7 @@ stage: Modified - name: Modified5477 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4068\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817003,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4068\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817003,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201058,7 +201058,7 @@ stage: Modified - name: Modified5478 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4069\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817003,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4069\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817003,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201079,7 +201079,7 @@ stage: Modified - name: Modified5479 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4070\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817004,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4070\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817004,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201100,7 +201100,7 @@ stage: Modified - name: Modified5480 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4071\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817004,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4071\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817004,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201121,7 +201121,7 @@ stage: Modified - name: Modified5481 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4072\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817004,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4072\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817004,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201142,7 +201142,7 @@ stage: Modified - name: Modified5482 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4073\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817004,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4073\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817004,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201163,7 +201163,7 @@ stage: Modified - name: Modified5483 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4074\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817005,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4074\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817005,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201184,7 +201184,7 @@ stage: Modified - name: Modified5484 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4075\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817005,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4075\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817005,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201205,7 +201205,7 @@ stage: Modified - name: Modified5485 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4076\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817005,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4076\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817005,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201226,7 +201226,7 @@ stage: Modified - name: Modified5486 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4077\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817005,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4077\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817005,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201247,7 +201247,7 @@ stage: Modified - name: Modified5487 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4078\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817006,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4078\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817006,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201268,7 +201268,7 @@ stage: Modified - name: Modified5488 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4079\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817006,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4079\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817006,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201289,93 +201289,93 @@ stage: Modified - name: Modified5489 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817006,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817006,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080\\reg_key", "arch": "[x64]", "timestamp": 1606817006, "attributes": {"type": "registry_key", "mtime": 1606770061, "checksum": "512355f63a6e240b2395b60dae41600ab27963f5"}}' stage: Modified - name: Modified5490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817007,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817007,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081\\reg_key", "arch": "[x64]", "timestamp": 1606817007, "attributes": {"type": "registry_key", "mtime": 1606770061, "checksum": "512355f63a6e240b2395b60dae41600ab27963f5"}}' stage: Modified - name: Modified5491 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817007,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817007,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082\\reg_key", "arch": "[x64]", "timestamp": 1606817007, "attributes": {"type": "registry_key", "mtime": 1606770061, "checksum": "512355f63a6e240b2395b60dae41600ab27963f5"}}' stage: Modified - name: Modified5492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817007,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817007,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083\\reg_key", "arch": "[x64]", "timestamp": 1606817007, "attributes": {"type": "registry_key", "mtime": 1606770061, "checksum": "512355f63a6e240b2395b60dae41600ab27963f5"}}' stage: Modified - name: Modified5493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817007,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817007,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084\\reg_key", "arch": "[x64]", "timestamp": 1606817007, "attributes": {"type": "registry_key", "mtime": 1606770061, "checksum": "512355f63a6e240b2395b60dae41600ab27963f5"}}' stage: Modified - name: Modified5494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817008,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817008,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085\\reg_key", "arch": "[x64]", "timestamp": 1606817008, "attributes": {"type": "registry_key", "mtime": 1606770061, "checksum": "512355f63a6e240b2395b60dae41600ab27963f5"}}' stage: Modified - name: Modified5495 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817009,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817009,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086\\reg_key", "arch": "[x64]", "timestamp": 1606817009, "attributes": {"type": "registry_key", "mtime": 1606770061, "checksum": "512355f63a6e240b2395b60dae41600ab27963f5"}}' stage: Modified - name: Modified5496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087\\reg_key","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817009,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606817009,"attributes":{"type":"registry_key","mtime":1606770061,"checksum":"512355f63a6e240b2395b60dae41600ab27963f5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087\\reg_key", "arch": "[x64]", "timestamp": 1606817009, "attributes": {"type": "registry_key", "mtime": 1606770061, "checksum": "512355f63a6e240b2395b60dae41600ab27963f5"}}' stage: Modified - name: Deleted5497 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key stage: Deleted - name: Deleted5498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4093\\reg_key stage: Deleted - name: Deleted5499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key stage: Deleted - name: Deleted5500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4094\\reg_key stage: Deleted - name: Deleted5501 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769891,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key stage: Deleted - name: Deleted5502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606769891,"attributes":{"type":"registry_value","checksum":"88ec0d411f4a59fd58ef679091d2f28d9f0f6619"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4095\\reg_key stage: Deleted - name: Modified5503 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201395,7 +201395,7 @@ stage: Modified - name: Modified5504 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201415,7 +201415,7 @@ stage: Modified - name: Modified5505 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201435,7 +201435,7 @@ stage: Modified - name: Modified5506 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201455,7 +201455,7 @@ stage: Modified - name: Modified5507 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201475,7 +201475,7 @@ stage: Modified - name: Modified5508 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201495,7 +201495,7 @@ stage: Modified - name: Modified5509 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201515,7 +201515,7 @@ stage: Modified - name: Modified5510 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201535,7 +201535,7 @@ stage: Modified - name: Modified5511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -201543,7 +201543,7 @@ stage: Modified - name: Modified5512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -201551,7 +201551,7 @@ stage: Modified - name: Modified5513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -201559,7 +201559,7 @@ stage: Modified - name: Modified5514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -201567,7 +201567,7 @@ stage: Modified - name: Modified5515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -201575,7 +201575,7 @@ stage: Modified - name: Modified5516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -201583,7 +201583,7 @@ stage: Modified - name: Modified5517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -201591,7 +201591,7 @@ stage: Modified - name: Modified5518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"f035fe86e524346702036d76a179359dd3118b4b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"93ad3971d0fc910ee9b1e75bcdf0dfe5bd8005a1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -201599,7 +201599,7 @@ stage: Modified - name: Modified5519 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201619,7 +201619,7 @@ stage: Modified - name: Modified5520 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201639,7 +201639,7 @@ stage: Modified - name: Modified5521 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201659,7 +201659,7 @@ stage: Modified - name: Modified5522 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201679,7 +201679,7 @@ stage: Modified - name: Modified5523 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201699,7 +201699,7 @@ stage: Modified - name: Modified5524 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201719,7 +201719,7 @@ stage: Modified - name: Modified5525 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201739,7 +201739,7 @@ stage: Modified - name: Modified5526 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201759,7 +201759,7 @@ stage: Modified - name: Modified5527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816981, @@ -201767,7 +201767,7 @@ stage: Modified - name: Modified5528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816981, @@ -201775,7 +201775,7 @@ stage: Modified - name: Modified5529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816981, @@ -201783,7 +201783,7 @@ stage: Modified - name: Modified5530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816981, @@ -201791,7 +201791,7 @@ stage: Modified - name: Modified5531 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816981, @@ -201799,7 +201799,7 @@ stage: Modified - name: Modified5532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816981, @@ -201807,7 +201807,7 @@ stage: Modified - name: Modified5533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816981, @@ -201815,7 +201815,7 @@ stage: Modified - name: Modified5534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816981,"checksum":"014800e6eeb475215b31cc3dfd2d919f3453010f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723043,"checksum":"ce35d15819820206841c9e1069460a66181c3d4a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816981, @@ -201823,7 +201823,7 @@ stage: Modified - name: Modified5535 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201843,7 +201843,7 @@ stage: Modified - name: Modified5536 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201863,7 +201863,7 @@ stage: Modified - name: Modified5537 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201883,7 +201883,7 @@ stage: Modified - name: Modified5538 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201903,7 +201903,7 @@ stage: Modified - name: Modified5539 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201923,7 +201923,7 @@ stage: Modified - name: Modified5540 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201943,7 +201943,7 @@ stage: Modified - name: Modified5541 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201963,7 +201963,7 @@ stage: Modified - name: Modified5542 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -201983,7 +201983,7 @@ stage: Modified - name: Modified5543 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -201991,7 +201991,7 @@ stage: Modified - name: Modified5544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -201999,7 +201999,7 @@ stage: Modified - name: Modified5545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202007,7 +202007,7 @@ stage: Modified - name: Modified5546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202015,7 +202015,7 @@ stage: Modified - name: Modified5547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202023,7 +202023,7 @@ stage: Modified - name: Modified5548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202031,7 +202031,7 @@ stage: Modified - name: Modified5549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202039,7 +202039,7 @@ stage: Modified - name: Modified5550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816981,"checksum":"331c59e55269bccc308f502fff13b4081550ddf9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723043,"checksum":"af6e257dbcb1fda04c6258ab377ff8ad98433654"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202047,7 +202047,7 @@ stage: Modified - name: Modified5551 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202066,7 +202066,7 @@ stage: Modified - name: Modified5552 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202085,7 +202085,7 @@ stage: Modified - name: Modified5553 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202104,7 +202104,7 @@ stage: Modified - name: Modified5554 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202123,7 +202123,7 @@ stage: Modified - name: Modified5555 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202142,7 +202142,7 @@ stage: Modified - name: Modified5556 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202161,7 +202161,7 @@ stage: Modified - name: Modified5557 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202180,7 +202180,7 @@ stage: Modified - name: Modified5558 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202199,63 +202199,63 @@ stage: Modified - name: Modified5559 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5561 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5563 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5565 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5567 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202275,7 +202275,7 @@ stage: Modified - name: Modified5568 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202295,7 +202295,7 @@ stage: Modified - name: Modified5569 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202315,7 +202315,7 @@ stage: Modified - name: Modified5570 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202335,7 +202335,7 @@ stage: Modified - name: Modified5571 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202355,7 +202355,7 @@ stage: Modified - name: Modified5572 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202375,7 +202375,7 @@ stage: Modified - name: Modified5573 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202395,7 +202395,7 @@ stage: Modified - name: Modified5574 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202415,7 +202415,7 @@ stage: Modified - name: Modified5575 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -202423,7 +202423,7 @@ stage: Modified - name: Modified5576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -202431,7 +202431,7 @@ stage: Modified - name: Modified5577 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -202439,7 +202439,7 @@ stage: Modified - name: Modified5578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -202447,7 +202447,7 @@ stage: Modified - name: Modified5579 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -202455,7 +202455,7 @@ stage: Modified - name: Modified5580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -202463,7 +202463,7 @@ stage: Modified - name: Modified5581 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -202471,7 +202471,7 @@ stage: Modified - name: Modified5582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"cd3d379054933420e36da12159bc2d3ad82935e4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151", "arch": "[x64]", "timestamp": 1606863810, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -202479,7 +202479,7 @@ stage: Modified - name: Modified5583 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202499,7 +202499,7 @@ stage: Modified - name: Modified5584 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863810,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202519,7 +202519,7 @@ stage: Modified - name: Modified5585 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202539,7 +202539,7 @@ stage: Modified - name: Modified5586 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202559,7 +202559,7 @@ stage: Modified - name: Modified5587 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202579,7 +202579,7 @@ stage: Modified - name: Modified5588 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202599,7 +202599,7 @@ stage: Modified - name: Modified5589 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202619,7 +202619,7 @@ stage: Modified - name: Modified5590 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202639,7 +202639,7 @@ stage: Modified - name: Modified5591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816982, @@ -202647,7 +202647,7 @@ stage: Modified - name: Modified5592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816982, @@ -202655,7 +202655,7 @@ stage: Modified - name: Modified5593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816982, @@ -202663,7 +202663,7 @@ stage: Modified - name: Modified5594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816982, @@ -202671,7 +202671,7 @@ stage: Modified - name: Modified5595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816982, @@ -202679,7 +202679,7 @@ stage: Modified - name: Modified5596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816982, @@ -202687,7 +202687,7 @@ stage: Modified - name: Modified5597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816982, @@ -202695,7 +202695,7 @@ stage: Modified - name: Modified5598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816982,"checksum":"c7eb41f983990f03cf7969add549446fefdde75d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723044,"checksum":"23ee24642ef4037725de36249f615590f49f8882"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816982, @@ -202703,7 +202703,7 @@ stage: Modified - name: Modified5599 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202723,7 +202723,7 @@ stage: Modified - name: Modified5600 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202743,7 +202743,7 @@ stage: Modified - name: Modified5601 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202763,7 +202763,7 @@ stage: Modified - name: Modified5602 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202783,7 +202783,7 @@ stage: Modified - name: Modified5603 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202803,7 +202803,7 @@ stage: Modified - name: Modified5604 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202823,7 +202823,7 @@ stage: Modified - name: Modified5605 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202843,7 +202843,7 @@ stage: Modified - name: Modified5606 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202863,7 +202863,7 @@ stage: Modified - name: Modified5607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202871,7 +202871,7 @@ stage: Modified - name: Modified5608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202879,7 +202879,7 @@ stage: Modified - name: Modified5609 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202887,7 +202887,7 @@ stage: Modified - name: Modified5610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202895,7 +202895,7 @@ stage: Modified - name: Modified5611 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202903,7 +202903,7 @@ stage: Modified - name: Modified5612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202911,7 +202911,7 @@ stage: Modified - name: Modified5613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202919,7 +202919,7 @@ stage: Modified - name: Modified5614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816982,"checksum":"3b63d616d217384164ed2a3003a61e2a3b1567c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"605239869d7386a8727d3ce5b10e11f70738095d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -202927,7 +202927,7 @@ stage: Modified - name: Modified5615 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202946,7 +202946,7 @@ stage: Modified - name: Modified5616 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202965,7 +202965,7 @@ stage: Modified - name: Modified5617 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -202984,7 +202984,7 @@ stage: Modified - name: Modified5618 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203003,7 +203003,7 @@ stage: Modified - name: Modified5619 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203022,7 +203022,7 @@ stage: Modified - name: Modified5620 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203041,7 +203041,7 @@ stage: Modified - name: Modified5621 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203060,7 +203060,7 @@ stage: Modified - name: Modified5622 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203079,63 +203079,63 @@ stage: Modified - name: Modified5623 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5625 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5627 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5629 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816982,"checksum":"3081613a27152bdcd1a5f5c8b13709fe62df12e9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723044,"checksum":"57113e0a23727b84d8df49c527a94ee706a6ebff"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816982, "checksum": "3081613a27152bdcd1a5f5c8b13709fe62df12e9"}}' stage: Modified - name: Modified5631 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203155,7 +203155,7 @@ stage: Modified - name: Modified5632 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203175,7 +203175,7 @@ stage: Modified - name: Modified5633 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203195,7 +203195,7 @@ stage: Modified - name: Modified5634 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203215,7 +203215,7 @@ stage: Modified - name: Modified5635 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203235,7 +203235,7 @@ stage: Modified - name: Modified5636 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203255,7 +203255,7 @@ stage: Modified - name: Modified5637 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203275,7 +203275,7 @@ stage: Modified - name: Modified5638 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203295,7 +203295,7 @@ stage: Modified - name: Modified5639 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723044,"checksum":"b54c4b188c893a5099855a3f61cb9ef67d070b7c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg272", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -203303,7 +203303,7 @@ stage: Modified - name: Modified5640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg273", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -203311,7 +203311,7 @@ stage: Modified - name: Modified5641 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg274", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -203319,7 +203319,7 @@ stage: Modified - name: Modified5642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg275", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -203327,7 +203327,7 @@ stage: Modified - name: Modified5643 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg276", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -203335,7 +203335,7 @@ stage: Modified - name: Modified5644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg277", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -203343,7 +203343,7 @@ stage: Modified - name: Modified5645 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg278", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -203351,7 +203351,7 @@ stage: Modified - name: Modified5646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ccccf493ea8a3f4deb44e95bfe2b48ac4a87b228"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg279", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -203359,7 +203359,7 @@ stage: Modified - name: Modified5647 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg288","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203379,7 +203379,7 @@ stage: Modified - name: Modified5648 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg289","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203399,7 +203399,7 @@ stage: Modified - name: Modified5649 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg290","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203419,7 +203419,7 @@ stage: Modified - name: Modified5650 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg291","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203439,7 +203439,7 @@ stage: Modified - name: Modified5651 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg292","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203459,7 +203459,7 @@ stage: Modified - name: Modified5652 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg293","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203479,7 +203479,7 @@ stage: Modified - name: Modified5653 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg294","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203499,7 +203499,7 @@ stage: Modified - name: Modified5654 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg295","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203519,7 +203519,7 @@ stage: Modified - name: Modified5655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg304", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816983, @@ -203527,7 +203527,7 @@ stage: Modified - name: Modified5656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg305", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816983, @@ -203535,7 +203535,7 @@ stage: Modified - name: Modified5657 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg306", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816983, @@ -203543,7 +203543,7 @@ stage: Modified - name: Modified5658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg307", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816983, @@ -203551,7 +203551,7 @@ stage: Modified - name: Modified5659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg308", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816983, @@ -203559,7 +203559,7 @@ stage: Modified - name: Modified5660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg309", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816983, @@ -203567,7 +203567,7 @@ stage: Modified - name: Modified5661 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg310", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816983, @@ -203575,7 +203575,7 @@ stage: Modified - name: Modified5662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816983,"checksum":"965980a5094745ea69c3c57f8a438cd4ce395c47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg311", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816983, @@ -203583,7 +203583,7 @@ stage: Modified - name: Modified5663 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg320","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203603,7 +203603,7 @@ stage: Modified - name: Modified5664 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg321","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203623,7 +203623,7 @@ stage: Modified - name: Modified5665 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg322","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203643,7 +203643,7 @@ stage: Modified - name: Modified5666 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg323","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203663,7 +203663,7 @@ stage: Modified - name: Modified5667 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg324","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203683,7 +203683,7 @@ stage: Modified - name: Modified5668 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg325","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203703,7 +203703,7 @@ stage: Modified - name: Modified5669 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg326","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203723,7 +203723,7 @@ stage: Modified - name: Modified5670 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg327","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203743,7 +203743,7 @@ stage: Modified - name: Modified5671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg336", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -203751,7 +203751,7 @@ stage: Modified - name: Modified5672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg337", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -203759,7 +203759,7 @@ stage: Modified - name: Modified5673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg338", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -203767,7 +203767,7 @@ stage: Modified - name: Modified5674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg339", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -203775,7 +203775,7 @@ stage: Modified - name: Modified5675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg340", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -203783,7 +203783,7 @@ stage: Modified - name: Modified5676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg341", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -203791,7 +203791,7 @@ stage: Modified - name: Modified5677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg342", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -203799,7 +203799,7 @@ stage: Modified - name: Modified5678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816983,"checksum":"ba4abed04b9987156a609b73ad8ee68b81c0c347"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"af3cfd5e4a35888469c974f9326a71e11d68ad85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg343", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -203807,7 +203807,7 @@ stage: Modified - name: Modified5679 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg352","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203826,7 +203826,7 @@ stage: Modified - name: Modified5680 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg353","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203845,7 +203845,7 @@ stage: Modified - name: Modified5681 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg354","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203864,7 +203864,7 @@ stage: Modified - name: Modified5682 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg355","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203883,7 +203883,7 @@ stage: Modified - name: Modified5683 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg356","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203902,7 +203902,7 @@ stage: Modified - name: Modified5684 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg357","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203921,7 +203921,7 @@ stage: Modified - name: Modified5685 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg358","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203940,7 +203940,7 @@ stage: Modified - name: Modified5686 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg359","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -203959,63 +203959,63 @@ stage: Modified - name: Modified5687 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg368", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816983, "checksum": "5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"}}' stage: Modified - name: Modified5688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg369", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816983, "checksum": "5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"}}' stage: Modified - name: Modified5689 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg370", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816983, "checksum": "5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"}}' stage: Modified - name: Modified5690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg371", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816983, "checksum": "5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"}}' stage: Modified - name: Modified5691 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg372", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816983, "checksum": "5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"}}' stage: Modified - name: Modified5692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg373", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816983, "checksum": "5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"}}' stage: Modified - name: Modified5693 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg374", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816983, "checksum": "5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"}}' stage: Modified - name: Modified5694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816983,"checksum":"5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723045,"checksum":"57f6bec2778f58dcb8502e90d62048d5b71929bc"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg375", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816983, "checksum": "5c12d64ff38bc3b80dfd39f70fbe66a5c43545d7"}}' stage: Modified - name: Modified5695 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg384","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204035,7 +204035,7 @@ stage: Modified - name: Modified5696 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg385","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204055,7 +204055,7 @@ stage: Modified - name: Modified5697 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg386","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204075,7 +204075,7 @@ stage: Modified - name: Modified5698 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg387","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204095,7 +204095,7 @@ stage: Modified - name: Modified5699 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg388","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204115,7 +204115,7 @@ stage: Modified - name: Modified5700 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg389","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204135,7 +204135,7 @@ stage: Modified - name: Modified5701 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg390","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204155,7 +204155,7 @@ stage: Modified - name: Modified5702 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg391","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204175,7 +204175,7 @@ stage: Modified - name: Modified5703 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg400", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -204183,7 +204183,7 @@ stage: Modified - name: Modified5704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg401", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -204191,7 +204191,7 @@ stage: Modified - name: Modified5705 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg402", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -204199,7 +204199,7 @@ stage: Modified - name: Modified5706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg403", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -204207,7 +204207,7 @@ stage: Modified - name: Modified5707 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg404", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -204215,7 +204215,7 @@ stage: Modified - name: Modified5708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg405", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -204223,7 +204223,7 @@ stage: Modified - name: Modified5709 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg406", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -204231,7 +204231,7 @@ stage: Modified - name: Modified5710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723045,"checksum":"342ed37868edc4d04ebdee7556cf58ba546a1b85"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg407", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -204239,7 +204239,7 @@ stage: Modified - name: Modified5711 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg416","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204259,7 +204259,7 @@ stage: Modified - name: Modified5712 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg417","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204279,7 +204279,7 @@ stage: Modified - name: Modified5713 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg418","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204299,7 +204299,7 @@ stage: Modified - name: Modified5714 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg419","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204319,7 +204319,7 @@ stage: Modified - name: Modified5715 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg420","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204339,7 +204339,7 @@ stage: Modified - name: Modified5716 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg421","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204359,7 +204359,7 @@ stage: Modified - name: Modified5717 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg422","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204379,7 +204379,7 @@ stage: Modified - name: Modified5718 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg423","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204399,7 +204399,7 @@ stage: Modified - name: Modified5719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg432", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816984, @@ -204407,7 +204407,7 @@ stage: Modified - name: Modified5720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg433", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816984, @@ -204415,7 +204415,7 @@ stage: Modified - name: Modified5721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg434", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816984, @@ -204423,7 +204423,7 @@ stage: Modified - name: Modified5722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg435", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816984, @@ -204431,7 +204431,7 @@ stage: Modified - name: Modified5723 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg436", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816984, @@ -204439,7 +204439,7 @@ stage: Modified - name: Modified5724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg437", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816984, @@ -204447,7 +204447,7 @@ stage: Modified - name: Modified5725 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg438", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816984, @@ -204455,7 +204455,7 @@ stage: Modified - name: Modified5726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816984,"checksum":"a48ccc0c70928fd8d025c9aaef7df7f2e5e1bc56"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723045,"checksum":"38bbef6acd436d4d5d0ab1ec761f26eaed60bd4f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg439", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816984, @@ -204463,7 +204463,7 @@ stage: Modified - name: Modified5727 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg448","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204483,7 +204483,7 @@ stage: Modified - name: Modified5728 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg449","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204503,7 +204503,7 @@ stage: Modified - name: Modified5729 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg450","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204523,7 +204523,7 @@ stage: Modified - name: Modified5730 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg451","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204543,7 +204543,7 @@ stage: Modified - name: Modified5731 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg452","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204563,7 +204563,7 @@ stage: Modified - name: Modified5732 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg453","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204583,7 +204583,7 @@ stage: Modified - name: Modified5733 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg454","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204603,7 +204603,7 @@ stage: Modified - name: Modified5734 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg455","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204623,7 +204623,7 @@ stage: Modified - name: Modified5735 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg464", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -204631,7 +204631,7 @@ stage: Modified - name: Modified5736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg465", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -204639,7 +204639,7 @@ stage: Modified - name: Modified5737 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg466", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -204647,7 +204647,7 @@ stage: Modified - name: Modified5738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg467", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -204655,7 +204655,7 @@ stage: Modified - name: Modified5739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg468", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -204663,7 +204663,7 @@ stage: Modified - name: Modified5740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg469", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -204671,7 +204671,7 @@ stage: Modified - name: Modified5741 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg470", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -204679,7 +204679,7 @@ stage: Modified - name: Modified5742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"6a05d04a2746d41c1ed3f89fe1f0832b8a30d7a5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg471", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -204687,7 +204687,7 @@ stage: Modified - name: Modified5743 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg480","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204706,7 +204706,7 @@ stage: Modified - name: Modified5744 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg481","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204725,7 +204725,7 @@ stage: Modified - name: Modified5745 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg482","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204744,7 +204744,7 @@ stage: Modified - name: Modified5746 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg483","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204763,7 +204763,7 @@ stage: Modified - name: Modified5747 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg484","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204782,7 +204782,7 @@ stage: Modified - name: Modified5748 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg485","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204801,7 +204801,7 @@ stage: Modified - name: Modified5749 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg486","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204820,7 +204820,7 @@ stage: Modified - name: Modified5750 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg487","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204839,63 +204839,63 @@ stage: Modified - name: Modified5751 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg496", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816984, "checksum": "082391488e7a25c1dd8ab709fd463dbafb01ba41"}}' stage: Modified - name: Modified5752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg497", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816984, "checksum": "082391488e7a25c1dd8ab709fd463dbafb01ba41"}}' stage: Modified - name: Modified5753 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg498", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816984, "checksum": "082391488e7a25c1dd8ab709fd463dbafb01ba41"}}' stage: Modified - name: Modified5754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg499", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816984, "checksum": "082391488e7a25c1dd8ab709fd463dbafb01ba41"}}' stage: Modified - name: Modified5755 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg500", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816984, "checksum": "082391488e7a25c1dd8ab709fd463dbafb01ba41"}}' stage: Modified - name: Modified5756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg501", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816984, "checksum": "082391488e7a25c1dd8ab709fd463dbafb01ba41"}}' stage: Modified - name: Modified5757 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg502", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816984, "checksum": "082391488e7a25c1dd8ab709fd463dbafb01ba41"}}' stage: Modified - name: Modified5758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816984,"checksum":"082391488e7a25c1dd8ab709fd463dbafb01ba41"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg503", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816984, "checksum": "082391488e7a25c1dd8ab709fd463dbafb01ba41"}}' stage: Modified - name: Modified5759 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg512","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204915,7 +204915,7 @@ stage: Modified - name: Modified5760 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg513","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204935,7 +204935,7 @@ stage: Modified - name: Modified5761 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg514","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204955,7 +204955,7 @@ stage: Modified - name: Modified5762 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg515","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204975,7 +204975,7 @@ stage: Modified - name: Modified5763 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg516","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -204995,7 +204995,7 @@ stage: Modified - name: Modified5764 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg517","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205015,7 +205015,7 @@ stage: Modified - name: Modified5765 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg518","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205035,7 +205035,7 @@ stage: Modified - name: Modified5766 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg519","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205055,7 +205055,7 @@ stage: Modified - name: Modified5767 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg528", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205063,7 +205063,7 @@ stage: Modified - name: Modified5768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg529", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205071,7 +205071,7 @@ stage: Modified - name: Modified5769 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg530", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205079,7 +205079,7 @@ stage: Modified - name: Modified5770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg531", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205087,7 +205087,7 @@ stage: Modified - name: Modified5771 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg532", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205095,7 +205095,7 @@ stage: Modified - name: Modified5772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg533", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205103,7 +205103,7 @@ stage: Modified - name: Modified5773 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg534", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205111,7 +205111,7 @@ stage: Modified - name: Modified5774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816984,"checksum":"1ed787f40fb62f40667287d6689d5af9ffc31d02"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"133836a0699c1e0a1f08e81362c288062b7f0a73"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg535", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205119,7 +205119,7 @@ stage: Modified - name: Modified5775 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg544","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205139,7 +205139,7 @@ stage: Modified - name: Modified5776 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg545","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205159,7 +205159,7 @@ stage: Modified - name: Modified5777 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg546","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205179,7 +205179,7 @@ stage: Modified - name: Modified5778 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg547","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205199,7 +205199,7 @@ stage: Modified - name: Modified5779 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg548","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205219,7 +205219,7 @@ stage: Modified - name: Modified5780 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg549","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205239,7 +205239,7 @@ stage: Modified - name: Modified5781 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg550","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205259,7 +205259,7 @@ stage: Modified - name: Modified5782 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg551","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205279,7 +205279,7 @@ stage: Modified - name: Modified5783 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg560", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -205287,7 +205287,7 @@ stage: Modified - name: Modified5784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg561", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -205295,7 +205295,7 @@ stage: Modified - name: Modified5785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg562", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -205303,7 +205303,7 @@ stage: Modified - name: Modified5786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg563", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -205311,7 +205311,7 @@ stage: Modified - name: Modified5787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg564", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -205319,7 +205319,7 @@ stage: Modified - name: Modified5788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg565", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -205327,7 +205327,7 @@ stage: Modified - name: Modified5789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg566", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -205335,7 +205335,7 @@ stage: Modified - name: Modified5790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723046,"checksum":"98e6796f568cb58d930f4fb2218f84f656ea2032"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg567", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -205343,7 +205343,7 @@ stage: Modified - name: Modified5791 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg576","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205363,7 +205363,7 @@ stage: Modified - name: Modified5792 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg577","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205383,7 +205383,7 @@ stage: Modified - name: Modified5793 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg578","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205403,7 +205403,7 @@ stage: Modified - name: Modified5794 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg579","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205423,7 +205423,7 @@ stage: Modified - name: Modified5795 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg580","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205443,7 +205443,7 @@ stage: Modified - name: Modified5796 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg581","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205463,7 +205463,7 @@ stage: Modified - name: Modified5797 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg582","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205483,7 +205483,7 @@ stage: Modified - name: Modified5798 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg583","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205503,7 +205503,7 @@ stage: Modified - name: Modified5799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg592", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -205511,7 +205511,7 @@ stage: Modified - name: Modified5800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg593", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -205519,7 +205519,7 @@ stage: Modified - name: Modified5801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg594", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -205527,7 +205527,7 @@ stage: Modified - name: Modified5802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg595", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -205535,7 +205535,7 @@ stage: Modified - name: Modified5803 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg596", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -205543,7 +205543,7 @@ stage: Modified - name: Modified5804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg597", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -205551,7 +205551,7 @@ stage: Modified - name: Modified5805 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg598", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -205559,7 +205559,7 @@ stage: Modified - name: Modified5806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"868557d655d43f9ee34c572bf6c136806890102e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723046,"checksum":"8e08a4016f159aa6f5299a4d3e67275615f41ce2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg599", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -205567,7 +205567,7 @@ stage: Modified - name: Modified5807 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg608","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205586,7 +205586,7 @@ stage: Modified - name: Modified5808 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg609","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205605,7 +205605,7 @@ stage: Modified - name: Modified5809 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg610","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205624,7 +205624,7 @@ stage: Modified - name: Modified5810 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg611","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205643,7 +205643,7 @@ stage: Modified - name: Modified5811 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg612","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205662,7 +205662,7 @@ stage: Modified - name: Modified5812 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg613","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205681,7 +205681,7 @@ stage: Modified - name: Modified5813 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg614","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205700,7 +205700,7 @@ stage: Modified - name: Modified5814 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg615","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205719,63 +205719,63 @@ stage: Modified - name: Modified5815 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg624", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816985, "checksum": "2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"}}' stage: Modified - name: Modified5816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg625", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816985, "checksum": "2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"}}' stage: Modified - name: Modified5817 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg626", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816985, "checksum": "2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"}}' stage: Modified - name: Modified5818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg627", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816985, "checksum": "2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"}}' stage: Modified - name: Modified5819 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg628", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816985, "checksum": "2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"}}' stage: Modified - name: Modified5820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723046,"checksum":"65b648360e3cbd1f6a4197fc5d1f40419c987e61"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg629", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816985, "checksum": "2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"}}' stage: Modified - name: Modified5821 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863811,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg630", "arch": "[x64]", "timestamp": 1606863811, "attributes": {"type": "registry_key", "mtime": 1606816985, "checksum": "2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"}}' stage: Modified - name: Modified5822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816985,"checksum":"2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg631", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816985, "checksum": "2e7cf25fe6df2b406c971cfbdc848e3aa206faaf"}}' stage: Modified - name: Modified5823 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg640","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205795,7 +205795,7 @@ stage: Modified - name: Modified5824 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg641","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205815,7 +205815,7 @@ stage: Modified - name: Modified5825 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg642","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205835,7 +205835,7 @@ stage: Modified - name: Modified5826 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg643","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205855,7 +205855,7 @@ stage: Modified - name: Modified5827 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg644","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205875,7 +205875,7 @@ stage: Modified - name: Modified5828 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg645","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205895,7 +205895,7 @@ stage: Modified - name: Modified5829 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg646","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205915,7 +205915,7 @@ stage: Modified - name: Modified5830 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg647","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -205935,7 +205935,7 @@ stage: Modified - name: Modified5831 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg656", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205943,7 +205943,7 @@ stage: Modified - name: Modified5832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg657", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205951,7 +205951,7 @@ stage: Modified - name: Modified5833 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg658", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205959,7 +205959,7 @@ stage: Modified - name: Modified5834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg659", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205967,7 +205967,7 @@ stage: Modified - name: Modified5835 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg660", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205975,7 +205975,7 @@ stage: Modified - name: Modified5836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg661", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205983,7 +205983,7 @@ stage: Modified - name: Modified5837 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg662", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205991,7 +205991,7 @@ stage: Modified - name: Modified5838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816985,"checksum":"95b65f751eafb16b85fe827fb3926e0fae39df5b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg663", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -205999,7 +205999,7 @@ stage: Modified - name: Modified5839 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg672","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206019,7 +206019,7 @@ stage: Modified - name: Modified5840 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg673","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206039,7 +206039,7 @@ stage: Modified - name: Modified5841 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg674","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206059,7 +206059,7 @@ stage: Modified - name: Modified5842 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg675","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206079,7 +206079,7 @@ stage: Modified - name: Modified5843 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg676","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206099,7 +206099,7 @@ stage: Modified - name: Modified5844 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg677","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206119,7 +206119,7 @@ stage: Modified - name: Modified5845 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg678","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206139,7 +206139,7 @@ stage: Modified - name: Modified5846 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg679","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206159,7 +206159,7 @@ stage: Modified - name: Modified5847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg688", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -206167,7 +206167,7 @@ stage: Modified - name: Modified5848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg689", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -206175,7 +206175,7 @@ stage: Modified - name: Modified5849 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg690", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -206183,7 +206183,7 @@ stage: Modified - name: Modified5850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg691", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -206191,7 +206191,7 @@ stage: Modified - name: Modified5851 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg692", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -206199,7 +206199,7 @@ stage: Modified - name: Modified5852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816985,"checksum":"f26b8e5739c66abc0488e593ec69abfdbd572562"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg693", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816985, @@ -206207,7 +206207,7 @@ stage: Modified - name: Modified5853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg694", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816986, @@ -206215,7 +206215,7 @@ stage: Modified - name: Modified5854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723047,"checksum":"105bc84d5f0af4799b484d527abb2ae5f7460201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg695", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816986, @@ -206223,7 +206223,7 @@ stage: Modified - name: Modified5855 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg704","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206243,7 +206243,7 @@ stage: Modified - name: Modified5856 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg705","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206263,7 +206263,7 @@ stage: Modified - name: Modified5857 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg706","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206283,7 +206283,7 @@ stage: Modified - name: Modified5858 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg707","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206303,7 +206303,7 @@ stage: Modified - name: Modified5859 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg708","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206323,7 +206323,7 @@ stage: Modified - name: Modified5860 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg709","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206343,7 +206343,7 @@ stage: Modified - name: Modified5861 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg710","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206363,7 +206363,7 @@ stage: Modified - name: Modified5862 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg711","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206383,7 +206383,7 @@ stage: Modified - name: Modified5863 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg720", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -206391,7 +206391,7 @@ stage: Modified - name: Modified5864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg721", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -206399,7 +206399,7 @@ stage: Modified - name: Modified5865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg722", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -206407,7 +206407,7 @@ stage: Modified - name: Modified5866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg723", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -206415,7 +206415,7 @@ stage: Modified - name: Modified5867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg724", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -206423,7 +206423,7 @@ stage: Modified - name: Modified5868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg725", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -206431,7 +206431,7 @@ stage: Modified - name: Modified5869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg726", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -206439,7 +206439,7 @@ stage: Modified - name: Modified5870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"4584ff00a345e2ecf888ef7a74d57fc5596bb068"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"44d3e05303cfb41f6243c2052843694c1dd963a0"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg727", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -206447,7 +206447,7 @@ stage: Modified - name: Modified5871 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg736","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206466,7 +206466,7 @@ stage: Modified - name: Modified5872 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg737","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206485,7 +206485,7 @@ stage: Modified - name: Modified5873 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg738","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206504,7 +206504,7 @@ stage: Modified - name: Modified5874 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg739","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206523,7 +206523,7 @@ stage: Modified - name: Modified5875 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg740","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206542,7 +206542,7 @@ stage: Modified - name: Modified5876 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg741","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206561,7 +206561,7 @@ stage: Modified - name: Modified5877 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg742","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206580,7 +206580,7 @@ stage: Modified - name: Modified5878 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg743","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206599,63 +206599,63 @@ stage: Modified - name: Modified5879 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg752", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816986, "checksum": "240ed69b364d96b43b785d76564da828719c9183"}}' stage: Modified - name: Modified5880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg753", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816986, "checksum": "240ed69b364d96b43b785d76564da828719c9183"}}' stage: Modified - name: Modified5881 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg754", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816986, "checksum": "240ed69b364d96b43b785d76564da828719c9183"}}' stage: Modified - name: Modified5882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg755", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816986, "checksum": "240ed69b364d96b43b785d76564da828719c9183"}}' stage: Modified - name: Modified5883 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg756", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816986, "checksum": "240ed69b364d96b43b785d76564da828719c9183"}}' stage: Modified - name: Modified5884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg757", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816986, "checksum": "240ed69b364d96b43b785d76564da828719c9183"}}' stage: Modified - name: Modified5885 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg758", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816986, "checksum": "240ed69b364d96b43b785d76564da828719c9183"}}' stage: Modified - name: Modified5886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816986,"checksum":"240ed69b364d96b43b785d76564da828719c9183"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723047,"checksum":"552dc0546f73b1bf9cf0b5761d7df26607a5e42f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg759", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816986, "checksum": "240ed69b364d96b43b785d76564da828719c9183"}}' stage: Modified - name: Modified5887 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg768","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206675,7 +206675,7 @@ stage: Modified - name: Modified5888 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg769","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206695,7 +206695,7 @@ stage: Modified - name: Modified5889 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg770","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206715,7 +206715,7 @@ stage: Modified - name: Modified5890 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg771","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206735,7 +206735,7 @@ stage: Modified - name: Modified5891 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg772","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206755,7 +206755,7 @@ stage: Modified - name: Modified5892 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg773","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206775,7 +206775,7 @@ stage: Modified - name: Modified5893 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg774","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206795,7 +206795,7 @@ stage: Modified - name: Modified5894 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg775","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206815,7 +206815,7 @@ stage: Modified - name: Modified5895 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg784", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -206823,7 +206823,7 @@ stage: Modified - name: Modified5896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg785", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -206831,7 +206831,7 @@ stage: Modified - name: Modified5897 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg786", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -206839,7 +206839,7 @@ stage: Modified - name: Modified5898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg787", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -206847,7 +206847,7 @@ stage: Modified - name: Modified5899 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg788", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -206855,7 +206855,7 @@ stage: Modified - name: Modified5900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg789", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -206863,7 +206863,7 @@ stage: Modified - name: Modified5901 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg790", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -206871,7 +206871,7 @@ stage: Modified - name: Modified5902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816986,"checksum":"8e3f7c0d39c01fd8c6e0b851958a09e2b8b59837"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723047,"checksum":"26bc64682db2287fb8a88b3f78c4089c6a5ad63d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg791", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -206879,7 +206879,7 @@ stage: Modified - name: Modified5903 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg800","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206899,7 +206899,7 @@ stage: Modified - name: Modified5904 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg801","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206919,7 +206919,7 @@ stage: Modified - name: Modified5905 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg802","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206939,7 +206939,7 @@ stage: Modified - name: Modified5906 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg803","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206959,7 +206959,7 @@ stage: Modified - name: Modified5907 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg804","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206979,7 +206979,7 @@ stage: Modified - name: Modified5908 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg805","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -206999,7 +206999,7 @@ stage: Modified - name: Modified5909 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg806","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207019,7 +207019,7 @@ stage: Modified - name: Modified5910 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg807","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207039,7 +207039,7 @@ stage: Modified - name: Modified5911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg816", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816986, @@ -207047,7 +207047,7 @@ stage: Modified - name: Modified5912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg817", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816986, @@ -207055,7 +207055,7 @@ stage: Modified - name: Modified5913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg818", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816986, @@ -207063,7 +207063,7 @@ stage: Modified - name: Modified5914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg819", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816986, @@ -207071,7 +207071,7 @@ stage: Modified - name: Modified5915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg820", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816986, @@ -207079,7 +207079,7 @@ stage: Modified - name: Modified5916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg821", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816986, @@ -207087,7 +207087,7 @@ stage: Modified - name: Modified5917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg822", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816986, @@ -207095,7 +207095,7 @@ stage: Modified - name: Modified5918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816986,"checksum":"d756c65fcc0fe5a2daff93231d17ec297fe524bf"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg823", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816986, @@ -207103,7 +207103,7 @@ stage: Modified - name: Modified5919 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg832","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207123,7 +207123,7 @@ stage: Modified - name: Modified5920 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg833","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207143,7 +207143,7 @@ stage: Modified - name: Modified5921 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg834","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207163,7 +207163,7 @@ stage: Modified - name: Modified5922 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg835","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207183,7 +207183,7 @@ stage: Modified - name: Modified5923 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg836","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207203,7 +207203,7 @@ stage: Modified - name: Modified5924 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg837","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207223,7 +207223,7 @@ stage: Modified - name: Modified5925 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg838","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207243,7 +207243,7 @@ stage: Modified - name: Modified5926 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg839","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207263,7 +207263,7 @@ stage: Modified - name: Modified5927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg848", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -207271,7 +207271,7 @@ stage: Modified - name: Modified5928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg849", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -207279,7 +207279,7 @@ stage: Modified - name: Modified5929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg850", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -207287,7 +207287,7 @@ stage: Modified - name: Modified5930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg851", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -207295,7 +207295,7 @@ stage: Modified - name: Modified5931 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg852", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -207303,7 +207303,7 @@ stage: Modified - name: Modified5932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg853", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -207311,7 +207311,7 @@ stage: Modified - name: Modified5933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg854", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -207319,7 +207319,7 @@ stage: Modified - name: Modified5934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"5bde100c0285a73b27341e80eab1625026549a74"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg855", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -207327,7 +207327,7 @@ stage: Modified - name: Modified5935 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg864","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207346,7 +207346,7 @@ stage: Modified - name: Modified5936 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg865","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207365,7 +207365,7 @@ stage: Modified - name: Modified5937 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg866","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207384,7 +207384,7 @@ stage: Modified - name: Modified5938 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg867","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207403,7 +207403,7 @@ stage: Modified - name: Modified5939 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg868","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207422,7 +207422,7 @@ stage: Modified - name: Modified5940 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg869","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207441,7 +207441,7 @@ stage: Modified - name: Modified5941 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg870","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207460,7 +207460,7 @@ stage: Modified - name: Modified5942 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg871","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207479,63 +207479,63 @@ stage: Modified - name: Modified5943 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg880", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816987, "checksum": "ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"}}' stage: Modified - name: Modified5944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg881", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816987, "checksum": "ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"}}' stage: Modified - name: Modified5945 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg882", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816987, "checksum": "ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"}}' stage: Modified - name: Modified5946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg883", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816987, "checksum": "ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"}}' stage: Modified - name: Modified5947 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg884", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816987, "checksum": "ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"}}' stage: Modified - name: Modified5948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg885", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816987, "checksum": "ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"}}' stage: Modified - name: Modified5949 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg886", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816987, "checksum": "ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"}}' stage: Modified - name: Modified5950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816987,"checksum":"ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723048,"checksum":"69d81fadce4dc9a7a8e9134c27b15f8571e81d09"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg887", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816987, "checksum": "ab86eb684a2d532d11dc0c4815dd568b6a1cc70c"}}' stage: Modified - name: Modified5951 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg896","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207555,7 +207555,7 @@ stage: Modified - name: Modified5952 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg897","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207575,7 +207575,7 @@ stage: Modified - name: Modified5953 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg898","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207595,7 +207595,7 @@ stage: Modified - name: Modified5954 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg899","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207615,7 +207615,7 @@ stage: Modified - name: Modified5955 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg900","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207635,7 +207635,7 @@ stage: Modified - name: Modified5956 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg901","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207655,7 +207655,7 @@ stage: Modified - name: Modified5957 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg902","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207675,7 +207675,7 @@ stage: Modified - name: Modified5958 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg903","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207695,7 +207695,7 @@ stage: Modified - name: Modified5959 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg912", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -207703,7 +207703,7 @@ stage: Modified - name: Modified5960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg913", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -207711,7 +207711,7 @@ stage: Modified - name: Modified5961 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg914", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -207719,7 +207719,7 @@ stage: Modified - name: Modified5962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg915", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -207727,7 +207727,7 @@ stage: Modified - name: Modified5963 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg916", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -207735,7 +207735,7 @@ stage: Modified - name: Modified5964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg917", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -207743,7 +207743,7 @@ stage: Modified - name: Modified5965 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg918", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -207751,7 +207751,7 @@ stage: Modified - name: Modified5966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"1b2441d760768ab82dfe3f2c2626407c237f179e"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723048,"checksum":"58fc6a536ca2297e91bed0b27d564d30fc47a883"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg919", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -207759,7 +207759,7 @@ stage: Modified - name: Modified5967 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg928","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207779,7 +207779,7 @@ stage: Modified - name: Modified5968 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg929","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207799,7 +207799,7 @@ stage: Modified - name: Modified5969 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg930","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207819,7 +207819,7 @@ stage: Modified - name: Modified5970 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg931","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207839,7 +207839,7 @@ stage: Modified - name: Modified5971 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg932","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207859,7 +207859,7 @@ stage: Modified - name: Modified5972 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg933","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207879,7 +207879,7 @@ stage: Modified - name: Modified5973 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg934","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207899,7 +207899,7 @@ stage: Modified - name: Modified5974 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg935","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -207919,7 +207919,7 @@ stage: Modified - name: Modified5975 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg944", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816987, @@ -207927,7 +207927,7 @@ stage: Modified - name: Modified5976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg945", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816987, @@ -207935,7 +207935,7 @@ stage: Modified - name: Modified5977 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723048,"checksum":"9f54650cd28dd893bea0c73915cd9725bf264b71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg946", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816987, @@ -207943,7 +207943,7 @@ stage: Modified - name: Modified5978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg947", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816987, @@ -207951,7 +207951,7 @@ stage: Modified - name: Modified5979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg948", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816987, @@ -207959,7 +207959,7 @@ stage: Modified - name: Modified5980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg949", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816987, @@ -207967,7 +207967,7 @@ stage: Modified - name: Modified5981 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg950", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816987, @@ -207975,7 +207975,7 @@ stage: Modified - name: Modified5982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816987,"checksum":"f5f96b9d696edb02c77b6570e0173c44d84632b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg951", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816987, @@ -207983,7 +207983,7 @@ stage: Modified - name: Modified5983 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg960","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208003,7 +208003,7 @@ stage: Modified - name: Modified5984 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg961","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208023,7 +208023,7 @@ stage: Modified - name: Modified5985 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg962","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208043,7 +208043,7 @@ stage: Modified - name: Modified5986 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg963","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208063,7 +208063,7 @@ stage: Modified - name: Modified5987 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg964","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208083,7 +208083,7 @@ stage: Modified - name: Modified5988 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg965","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208103,7 +208103,7 @@ stage: Modified - name: Modified5989 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg966","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208123,7 +208123,7 @@ stage: Modified - name: Modified5990 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg967","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208143,7 +208143,7 @@ stage: Modified - name: Modified5991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg976", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -208151,7 +208151,7 @@ stage: Modified - name: Modified5992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816987,"checksum":"8a4e85a2f7d0865af421b9156937015c12ea36d5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg977", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -208159,7 +208159,7 @@ stage: Modified - name: Modified5993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg978", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -208167,7 +208167,7 @@ stage: Modified - name: Modified5994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg979", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -208175,7 +208175,7 @@ stage: Modified - name: Modified5995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg980", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -208183,7 +208183,7 @@ stage: Modified - name: Modified5996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg981", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -208191,7 +208191,7 @@ stage: Modified - name: Modified5997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg982", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -208199,7 +208199,7 @@ stage: Modified - name: Modified5998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg983", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -208207,7 +208207,7 @@ stage: Modified - name: Modified5999 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg992","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208226,7 +208226,7 @@ stage: Modified - name: Modified6000 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg993","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208245,7 +208245,7 @@ stage: Modified - name: Modified6001 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg994","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208264,7 +208264,7 @@ stage: Modified - name: Modified6002 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg995","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208283,7 +208283,7 @@ stage: Modified - name: Modified6003 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg996","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208302,7 +208302,7 @@ stage: Modified - name: Modified6004 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg997","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208321,7 +208321,7 @@ stage: Modified - name: Modified6005 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg998","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208340,7 +208340,7 @@ stage: Modified - name: Modified6006 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg999","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208359,63 +208359,63 @@ stage: Modified - name: Modified6007 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1008", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816988, "checksum": "1eb2faf65c6a0f1dc845376e2f62e05388866f92"}}' stage: Modified - name: Modified6008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1009", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816988, "checksum": "1eb2faf65c6a0f1dc845376e2f62e05388866f92"}}' stage: Modified - name: Modified6009 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1010", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816988, "checksum": "1eb2faf65c6a0f1dc845376e2f62e05388866f92"}}' stage: Modified - name: Modified6010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1011", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816988, "checksum": "1eb2faf65c6a0f1dc845376e2f62e05388866f92"}}' stage: Modified - name: Modified6011 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1012", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816988, "checksum": "1eb2faf65c6a0f1dc845376e2f62e05388866f92"}}' stage: Modified - name: Modified6012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1013", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816988, "checksum": "1eb2faf65c6a0f1dc845376e2f62e05388866f92"}}' stage: Modified - name: Modified6013 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1014", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816988, "checksum": "1eb2faf65c6a0f1dc845376e2f62e05388866f92"}}' stage: Modified - name: Modified6014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816988,"checksum":"1eb2faf65c6a0f1dc845376e2f62e05388866f92"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723049,"checksum":"afb64885d606a63177f5440d2b43264870dfa59b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1015", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816988, "checksum": "1eb2faf65c6a0f1dc845376e2f62e05388866f92"}}' stage: Modified - name: Modified6015 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1024","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208435,7 +208435,7 @@ stage: Modified - name: Modified6016 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1025","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208455,7 +208455,7 @@ stage: Modified - name: Modified6017 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1026","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208475,7 +208475,7 @@ stage: Modified - name: Modified6018 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1027","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208495,7 +208495,7 @@ stage: Modified - name: Modified6019 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1028","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208515,7 +208515,7 @@ stage: Modified - name: Modified6020 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1029","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208535,7 +208535,7 @@ stage: Modified - name: Modified6021 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1030","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208555,7 +208555,7 @@ stage: Modified - name: Modified6022 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1031","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208575,7 +208575,7 @@ stage: Modified - name: Modified6023 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1040", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -208583,7 +208583,7 @@ stage: Modified - name: Modified6024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1041", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -208591,7 +208591,7 @@ stage: Modified - name: Modified6025 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1042", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -208599,7 +208599,7 @@ stage: Modified - name: Modified6026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1043", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -208607,7 +208607,7 @@ stage: Modified - name: Modified6027 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1044", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -208615,7 +208615,7 @@ stage: Modified - name: Modified6028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1045", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -208623,7 +208623,7 @@ stage: Modified - name: Modified6029 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1046", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -208631,7 +208631,7 @@ stage: Modified - name: Modified6030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"4702ece1e2311a4fbe8277341d8e3ac74a21cf58"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"f3c5909bb9385e454ff1bd4f2da2122cf32bcc24"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1047", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -208639,7 +208639,7 @@ stage: Modified - name: Modified6031 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1056","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208659,7 +208659,7 @@ stage: Modified - name: Modified6032 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1057","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208679,7 +208679,7 @@ stage: Modified - name: Modified6033 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1058","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208699,7 +208699,7 @@ stage: Modified - name: Modified6034 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1059","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208719,7 +208719,7 @@ stage: Modified - name: Modified6035 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1060","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208739,7 +208739,7 @@ stage: Modified - name: Modified6036 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1061","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208759,7 +208759,7 @@ stage: Modified - name: Modified6037 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1062","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208779,7 +208779,7 @@ stage: Modified - name: Modified6038 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1063","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208799,7 +208799,7 @@ stage: Modified - name: Modified6039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1072", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816988, @@ -208807,7 +208807,7 @@ stage: Modified - name: Modified6040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1073", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816988, @@ -208815,7 +208815,7 @@ stage: Modified - name: Modified6041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1074", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816988, @@ -208823,7 +208823,7 @@ stage: Modified - name: Modified6042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1075", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816988, @@ -208831,7 +208831,7 @@ stage: Modified - name: Modified6043 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1076", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816988, @@ -208839,7 +208839,7 @@ stage: Modified - name: Modified6044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1077", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816988, @@ -208847,7 +208847,7 @@ stage: Modified - name: Modified6045 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1078", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816988, @@ -208855,7 +208855,7 @@ stage: Modified - name: Modified6046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816988,"checksum":"5d6bae3aa3afc1e0126b4b7d109591bf28a5a7f2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723049,"checksum":"6e9598cd35d543cdd760dbe26e59d2590f40873b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1079", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816988, @@ -208863,7 +208863,7 @@ stage: Modified - name: Modified6047 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1088","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208883,7 +208883,7 @@ stage: Modified - name: Modified6048 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1089","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208903,7 +208903,7 @@ stage: Modified - name: Modified6049 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1090","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208923,7 +208923,7 @@ stage: Modified - name: Modified6050 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1091","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208943,7 +208943,7 @@ stage: Modified - name: Modified6051 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1092","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208963,7 +208963,7 @@ stage: Modified - name: Modified6052 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1093","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -208983,7 +208983,7 @@ stage: Modified - name: Modified6053 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1094","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209003,7 +209003,7 @@ stage: Modified - name: Modified6054 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1095","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209023,7 +209023,7 @@ stage: Modified - name: Modified6055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1104", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209031,7 +209031,7 @@ stage: Modified - name: Modified6056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1105", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209039,7 +209039,7 @@ stage: Modified - name: Modified6057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1106", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209047,7 +209047,7 @@ stage: Modified - name: Modified6058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1107", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209055,7 +209055,7 @@ stage: Modified - name: Modified6059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1108", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209063,7 +209063,7 @@ stage: Modified - name: Modified6060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1109", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209071,7 +209071,7 @@ stage: Modified - name: Modified6061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1110", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209079,7 +209079,7 @@ stage: Modified - name: Modified6062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816988,"checksum":"cb05dd05db620b3d39619085665233aa2777af88"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723049,"checksum":"7092adc4ac7b2550c12b574f138424ab8ac7d616"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1111", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209087,7 +209087,7 @@ stage: Modified - name: Modified6063 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1120","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209106,7 +209106,7 @@ stage: Modified - name: Modified6064 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1121","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209125,7 +209125,7 @@ stage: Modified - name: Modified6065 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1122","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209144,7 +209144,7 @@ stage: Modified - name: Modified6066 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1123","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209163,7 +209163,7 @@ stage: Modified - name: Modified6067 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1124","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209182,7 +209182,7 @@ stage: Modified - name: Modified6068 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1125","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209201,7 +209201,7 @@ stage: Modified - name: Modified6069 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1126","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209220,7 +209220,7 @@ stage: Modified - name: Modified6070 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1127","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209239,63 +209239,63 @@ stage: Modified - name: Modified6071 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1136", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1137", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6073 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1138", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1139", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6075 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1140", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1141", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6077 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1142", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1143", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6079 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1152","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209315,7 +209315,7 @@ stage: Modified - name: Modified6080 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1153","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209335,7 +209335,7 @@ stage: Modified - name: Modified6081 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1154","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209355,7 +209355,7 @@ stage: Modified - name: Modified6082 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1155","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209375,7 +209375,7 @@ stage: Modified - name: Modified6083 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1156","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209395,7 +209395,7 @@ stage: Modified - name: Modified6084 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1157","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209415,7 +209415,7 @@ stage: Modified - name: Modified6085 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1158","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209435,7 +209435,7 @@ stage: Modified - name: Modified6086 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1159","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209455,7 +209455,7 @@ stage: Modified - name: Modified6087 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1168", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -209463,7 +209463,7 @@ stage: Modified - name: Modified6088 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1169", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -209471,7 +209471,7 @@ stage: Modified - name: Modified6089 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863812,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1170", "arch": "[x64]", "timestamp": 1606863812, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -209479,7 +209479,7 @@ stage: Modified - name: Modified6090 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1171", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -209487,7 +209487,7 @@ stage: Modified - name: Modified6091 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1172", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -209495,7 +209495,7 @@ stage: Modified - name: Modified6092 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1173", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -209503,7 +209503,7 @@ stage: Modified - name: Modified6093 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1174", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -209511,7 +209511,7 @@ stage: Modified - name: Modified6094 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"900730ab9b9d3af4f844b014686269eb4890107a"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1175", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -209519,7 +209519,7 @@ stage: Modified - name: Modified6095 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1184","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209539,7 +209539,7 @@ stage: Modified - name: Modified6096 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1185","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209559,7 +209559,7 @@ stage: Modified - name: Modified6097 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1186","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209579,7 +209579,7 @@ stage: Modified - name: Modified6098 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1187","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209599,7 +209599,7 @@ stage: Modified - name: Modified6099 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1188","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209619,7 +209619,7 @@ stage: Modified - name: Modified6100 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1189","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209639,7 +209639,7 @@ stage: Modified - name: Modified6101 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1190","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209659,7 +209659,7 @@ stage: Modified - name: Modified6102 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1191","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209679,7 +209679,7 @@ stage: Modified - name: Modified6103 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1200", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816989, @@ -209687,7 +209687,7 @@ stage: Modified - name: Modified6104 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1201", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816989, @@ -209695,7 +209695,7 @@ stage: Modified - name: Modified6105 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1202", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816989, @@ -209703,7 +209703,7 @@ stage: Modified - name: Modified6106 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1203", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816989, @@ -209711,7 +209711,7 @@ stage: Modified - name: Modified6107 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1204", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816989, @@ -209719,7 +209719,7 @@ stage: Modified - name: Modified6108 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1205", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816989, @@ -209727,7 +209727,7 @@ stage: Modified - name: Modified6109 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1206", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816989, @@ -209735,7 +209735,7 @@ stage: Modified - name: Modified6110 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816989,"checksum":"1c46c86b010655de0752e0497820b750b4c5ac29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723050,"checksum":"f7c6c80f5df6ca7c662500a98a80db008c097e7b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1207", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816989, @@ -209743,7 +209743,7 @@ stage: Modified - name: Modified6111 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1216","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209763,7 +209763,7 @@ stage: Modified - name: Modified6112 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1217","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209783,7 +209783,7 @@ stage: Modified - name: Modified6113 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1218","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209803,7 +209803,7 @@ stage: Modified - name: Modified6114 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1219","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209823,7 +209823,7 @@ stage: Modified - name: Modified6115 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1220","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209843,7 +209843,7 @@ stage: Modified - name: Modified6116 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1221","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209863,7 +209863,7 @@ stage: Modified - name: Modified6117 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1222","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209883,7 +209883,7 @@ stage: Modified - name: Modified6118 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1223","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209903,7 +209903,7 @@ stage: Modified - name: Modified6119 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1232", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209911,7 +209911,7 @@ stage: Modified - name: Modified6120 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1233", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209919,7 +209919,7 @@ stage: Modified - name: Modified6121 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1234", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209927,7 +209927,7 @@ stage: Modified - name: Modified6122 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1235", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209935,7 +209935,7 @@ stage: Modified - name: Modified6123 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1236", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209943,7 +209943,7 @@ stage: Modified - name: Modified6124 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1237", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209951,7 +209951,7 @@ stage: Modified - name: Modified6125 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1238", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209959,7 +209959,7 @@ stage: Modified - name: Modified6126 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816989,"checksum":"71a7aae8da789cbb6978ae53640de0e70dd624e8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"9a59c66cddd022b36e55d6627d259451a5c8e013"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1239", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -209967,7 +209967,7 @@ stage: Modified - name: Modified6127 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1248","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -209986,7 +209986,7 @@ stage: Modified - name: Modified6128 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1249","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210005,7 +210005,7 @@ stage: Modified - name: Modified6129 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1250","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210024,7 +210024,7 @@ stage: Modified - name: Modified6130 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1251","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210043,7 +210043,7 @@ stage: Modified - name: Modified6131 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1252","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210062,7 +210062,7 @@ stage: Modified - name: Modified6132 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1253","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210081,7 +210081,7 @@ stage: Modified - name: Modified6133 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1254","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210100,7 +210100,7 @@ stage: Modified - name: Modified6134 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1255","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210119,63 +210119,63 @@ stage: Modified - name: Modified6135 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1264", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6136 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1265", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6137 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1266", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6138 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1267", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6139 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1268", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6140 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1269", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6141 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1270", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6142 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816989,"checksum":"e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723050,"checksum":"af8a218dff7360ccc41baff02a97f4326ed766a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1271", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816989, "checksum": "e15a868522b886bf8cb5b9b78fe6b4a34a7e5dad"}}' stage: Modified - name: Modified6143 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1280","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210195,7 +210195,7 @@ stage: Modified - name: Modified6144 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1281","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210215,7 +210215,7 @@ stage: Modified - name: Modified6145 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1282","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210235,7 +210235,7 @@ stage: Modified - name: Modified6146 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1283","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210255,7 +210255,7 @@ stage: Modified - name: Modified6147 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1284","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210275,7 +210275,7 @@ stage: Modified - name: Modified6148 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1285","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210295,7 +210295,7 @@ stage: Modified - name: Modified6149 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1286","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210315,7 +210315,7 @@ stage: Modified - name: Modified6150 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1287","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210335,7 +210335,7 @@ stage: Modified - name: Modified6151 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1296", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -210343,7 +210343,7 @@ stage: Modified - name: Modified6152 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1297", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -210351,7 +210351,7 @@ stage: Modified - name: Modified6153 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1298", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -210359,7 +210359,7 @@ stage: Modified - name: Modified6154 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1299", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -210367,7 +210367,7 @@ stage: Modified - name: Modified6155 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1300", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -210375,7 +210375,7 @@ stage: Modified - name: Modified6156 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723050,"checksum":"715723540ad8b03366894d0fb47484db9c693084"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1301", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -210383,7 +210383,7 @@ stage: Modified - name: Modified6157 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1302", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -210391,7 +210391,7 @@ stage: Modified - name: Modified6158 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"919da49647a38bafc0e3cf68c6a96e3776db48bb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1303", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -210399,7 +210399,7 @@ stage: Modified - name: Modified6159 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1312","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210419,7 +210419,7 @@ stage: Modified - name: Modified6160 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1313","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210439,7 +210439,7 @@ stage: Modified - name: Modified6161 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1314","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210459,7 +210459,7 @@ stage: Modified - name: Modified6162 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1315","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210479,7 +210479,7 @@ stage: Modified - name: Modified6163 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1316","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210499,7 +210499,7 @@ stage: Modified - name: Modified6164 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1317","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210519,7 +210519,7 @@ stage: Modified - name: Modified6165 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1318","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210539,7 +210539,7 @@ stage: Modified - name: Modified6166 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1319","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210559,7 +210559,7 @@ stage: Modified - name: Modified6167 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1328", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816990, @@ -210567,7 +210567,7 @@ stage: Modified - name: Modified6168 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1329", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816990, @@ -210575,7 +210575,7 @@ stage: Modified - name: Modified6169 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1330", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816990, @@ -210583,7 +210583,7 @@ stage: Modified - name: Modified6170 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1331", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816990, @@ -210591,7 +210591,7 @@ stage: Modified - name: Modified6171 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1332", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816990, @@ -210599,7 +210599,7 @@ stage: Modified - name: Modified6172 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1333", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816990, @@ -210607,7 +210607,7 @@ stage: Modified - name: Modified6173 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1334", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816990, @@ -210615,7 +210615,7 @@ stage: Modified - name: Modified6174 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816990,"checksum":"e2e50bbd9257232e7aa99f489b95097acfb2ceec"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1335", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816990, @@ -210623,7 +210623,7 @@ stage: Modified - name: Modified6175 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1344","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210643,7 +210643,7 @@ stage: Modified - name: Modified6176 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1345","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210663,7 +210663,7 @@ stage: Modified - name: Modified6177 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1346","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210683,7 +210683,7 @@ stage: Modified - name: Modified6178 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1347","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210703,7 +210703,7 @@ stage: Modified - name: Modified6179 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1348","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210723,7 +210723,7 @@ stage: Modified - name: Modified6180 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1349","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210743,7 +210743,7 @@ stage: Modified - name: Modified6181 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1350","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210763,7 +210763,7 @@ stage: Modified - name: Modified6182 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1351","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210783,7 +210783,7 @@ stage: Modified - name: Modified6183 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1360", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -210791,7 +210791,7 @@ stage: Modified - name: Modified6184 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1361", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -210799,7 +210799,7 @@ stage: Modified - name: Modified6185 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1362", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -210807,7 +210807,7 @@ stage: Modified - name: Modified6186 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1363", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -210815,7 +210815,7 @@ stage: Modified - name: Modified6187 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1364", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -210823,7 +210823,7 @@ stage: Modified - name: Modified6188 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1365", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -210831,7 +210831,7 @@ stage: Modified - name: Modified6189 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1366", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -210839,7 +210839,7 @@ stage: Modified - name: Modified6190 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816990,"checksum":"2156972ff4686e69396cc44c773ec4e8fa981ef6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"8b865bb3f30f3df6e465b6ea938510334eca9770"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1367", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -210847,7 +210847,7 @@ stage: Modified - name: Modified6191 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1376","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210866,7 +210866,7 @@ stage: Modified - name: Modified6192 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1377","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210885,7 +210885,7 @@ stage: Modified - name: Modified6193 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1378","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210904,7 +210904,7 @@ stage: Modified - name: Modified6194 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1379","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210923,7 +210923,7 @@ stage: Modified - name: Modified6195 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1380","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210942,7 +210942,7 @@ stage: Modified - name: Modified6196 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1381","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210961,7 +210961,7 @@ stage: Modified - name: Modified6197 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1382","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210980,7 +210980,7 @@ stage: Modified - name: Modified6198 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1383","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -210999,63 +210999,63 @@ stage: Modified - name: Modified6199 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1392", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816990, "checksum": "6ccdd37e43f864eb9955e44d11c75499e644bfe6"}}' stage: Modified - name: Modified6200 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1393", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816990, "checksum": "6ccdd37e43f864eb9955e44d11c75499e644bfe6"}}' stage: Modified - name: Modified6201 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1394", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816990, "checksum": "6ccdd37e43f864eb9955e44d11c75499e644bfe6"}}' stage: Modified - name: Modified6202 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1395", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816990, "checksum": "6ccdd37e43f864eb9955e44d11c75499e644bfe6"}}' stage: Modified - name: Modified6203 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1396", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816990, "checksum": "6ccdd37e43f864eb9955e44d11c75499e644bfe6"}}' stage: Modified - name: Modified6204 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1397", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816990, "checksum": "6ccdd37e43f864eb9955e44d11c75499e644bfe6"}}' stage: Modified - name: Modified6205 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1398", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816990, "checksum": "6ccdd37e43f864eb9955e44d11c75499e644bfe6"}}' stage: Modified - name: Modified6206 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816990,"checksum":"6ccdd37e43f864eb9955e44d11c75499e644bfe6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723051,"checksum":"6c9ab9ed8c1e68246d7c45fc040f5ed1249c3e17"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1399", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816990, "checksum": "6ccdd37e43f864eb9955e44d11c75499e644bfe6"}}' stage: Modified - name: Modified6207 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1408","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211075,7 +211075,7 @@ stage: Modified - name: Modified6208 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1409","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211095,7 +211095,7 @@ stage: Modified - name: Modified6209 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1410","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211115,7 +211115,7 @@ stage: Modified - name: Modified6210 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1411","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211135,7 +211135,7 @@ stage: Modified - name: Modified6211 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1412","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211155,7 +211155,7 @@ stage: Modified - name: Modified6212 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1413","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211175,7 +211175,7 @@ stage: Modified - name: Modified6213 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1414","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211195,7 +211195,7 @@ stage: Modified - name: Modified6214 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1415","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211215,7 +211215,7 @@ stage: Modified - name: Modified6215 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1424", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -211223,7 +211223,7 @@ stage: Modified - name: Modified6216 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1425", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -211231,7 +211231,7 @@ stage: Modified - name: Modified6217 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1426", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -211239,7 +211239,7 @@ stage: Modified - name: Modified6218 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1427", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -211247,7 +211247,7 @@ stage: Modified - name: Modified6219 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1428", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -211255,7 +211255,7 @@ stage: Modified - name: Modified6220 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1429", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -211263,7 +211263,7 @@ stage: Modified - name: Modified6221 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1430", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -211271,7 +211271,7 @@ stage: Modified - name: Modified6222 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723051,"checksum":"6a655fdb7a174bf01657f6bbf9b9d3c091161dda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1431", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -211279,7 +211279,7 @@ stage: Modified - name: Modified6223 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1440","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211299,7 +211299,7 @@ stage: Modified - name: Modified6224 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1441","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211319,7 +211319,7 @@ stage: Modified - name: Modified6225 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1442","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211339,7 +211339,7 @@ stage: Modified - name: Modified6226 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1443","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211359,7 +211359,7 @@ stage: Modified - name: Modified6227 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1444","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211379,7 +211379,7 @@ stage: Modified - name: Modified6228 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1445","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211399,7 +211399,7 @@ stage: Modified - name: Modified6229 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1446","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211419,7 +211419,7 @@ stage: Modified - name: Modified6230 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1447","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211439,7 +211439,7 @@ stage: Modified - name: Modified6231 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1456", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816991, @@ -211447,7 +211447,7 @@ stage: Modified - name: Modified6232 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1457", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816991, @@ -211455,7 +211455,7 @@ stage: Modified - name: Modified6233 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1458", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816991, @@ -211463,7 +211463,7 @@ stage: Modified - name: Modified6234 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1459", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816991, @@ -211471,7 +211471,7 @@ stage: Modified - name: Modified6235 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1460", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816991, @@ -211479,7 +211479,7 @@ stage: Modified - name: Modified6236 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1461", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816991, @@ -211487,7 +211487,7 @@ stage: Modified - name: Modified6237 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1462", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816991, @@ -211495,7 +211495,7 @@ stage: Modified - name: Modified6238 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816991,"checksum":"c601e635b0ec864d92a01269eaf605873fb045bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723051,"checksum":"ca4d3665599684af87d551c0ec594f80d69e2672"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1463", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816991, @@ -211503,7 +211503,7 @@ stage: Modified - name: Modified6239 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1472","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211523,7 +211523,7 @@ stage: Modified - name: Modified6240 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1473","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211543,7 +211543,7 @@ stage: Modified - name: Modified6241 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1474","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211563,7 +211563,7 @@ stage: Modified - name: Modified6242 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1475","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211583,7 +211583,7 @@ stage: Modified - name: Modified6243 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1476","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211603,7 +211603,7 @@ stage: Modified - name: Modified6244 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1477","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211623,7 +211623,7 @@ stage: Modified - name: Modified6245 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1478","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211643,7 +211643,7 @@ stage: Modified - name: Modified6246 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1479","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211663,7 +211663,7 @@ stage: Modified - name: Modified6247 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1488", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -211671,7 +211671,7 @@ stage: Modified - name: Modified6248 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1489", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -211679,7 +211679,7 @@ stage: Modified - name: Modified6249 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1490", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -211687,7 +211687,7 @@ stage: Modified - name: Modified6250 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1491", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -211695,7 +211695,7 @@ stage: Modified - name: Modified6251 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1492", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -211703,7 +211703,7 @@ stage: Modified - name: Modified6252 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1493", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -211711,7 +211711,7 @@ stage: Modified - name: Modified6253 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1494", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -211719,7 +211719,7 @@ stage: Modified - name: Modified6254 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"fe50d661fce72ff743d0cb4d7e6d0c244de27e51"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1495", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -211727,7 +211727,7 @@ stage: Modified - name: Modified6255 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1504","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211746,7 +211746,7 @@ stage: Modified - name: Modified6256 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1505","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211765,7 +211765,7 @@ stage: Modified - name: Modified6257 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1506","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211784,7 +211784,7 @@ stage: Modified - name: Modified6258 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1507","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211803,7 +211803,7 @@ stage: Modified - name: Modified6259 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1508","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211822,7 +211822,7 @@ stage: Modified - name: Modified6260 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1509","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211841,7 +211841,7 @@ stage: Modified - name: Modified6261 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1510","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211860,7 +211860,7 @@ stage: Modified - name: Modified6262 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1511","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211879,63 +211879,63 @@ stage: Modified - name: Modified6263 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1520", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816991, "checksum": "41ddcf287cc347e498a944843d7981642d68a918"}}' stage: Modified - name: Modified6264 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1521", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816991, "checksum": "41ddcf287cc347e498a944843d7981642d68a918"}}' stage: Modified - name: Modified6265 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1522", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816991, "checksum": "41ddcf287cc347e498a944843d7981642d68a918"}}' stage: Modified - name: Modified6266 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1523", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816991, "checksum": "41ddcf287cc347e498a944843d7981642d68a918"}}' stage: Modified - name: Modified6267 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1524", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816991, "checksum": "41ddcf287cc347e498a944843d7981642d68a918"}}' stage: Modified - name: Modified6268 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1525", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816991, "checksum": "41ddcf287cc347e498a944843d7981642d68a918"}}' stage: Modified - name: Modified6269 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1526", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816991, "checksum": "41ddcf287cc347e498a944843d7981642d68a918"}}' stage: Modified - name: Modified6270 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","mtime":1606816991,"checksum":"41ddcf287cc347e498a944843d7981642d68a918"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723052,"checksum":"61bff0dd0470adcda8c683a882946c3c85b5a3d8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1527", "arch": "[x64]", "timestamp": 1606863813, "attributes": {"type": "registry_key", "mtime": 1606816991, "checksum": "41ddcf287cc347e498a944843d7981642d68a918"}}' stage: Modified - name: Modified6271 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1536","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211955,7 +211955,7 @@ stage: Modified - name: Modified6272 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1537","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211975,7 +211975,7 @@ stage: Modified - name: Modified6273 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1538","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863813,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -211995,7 +211995,7 @@ stage: Modified - name: Modified6274 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1539","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212015,7 +212015,7 @@ stage: Modified - name: Modified6275 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1540","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212035,7 +212035,7 @@ stage: Modified - name: Modified6276 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1541","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212055,7 +212055,7 @@ stage: Modified - name: Modified6277 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1542","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212075,7 +212075,7 @@ stage: Modified - name: Modified6278 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1543","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212095,7 +212095,7 @@ stage: Modified - name: Modified6279 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1552", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -212103,7 +212103,7 @@ stage: Modified - name: Modified6280 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1553", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -212111,7 +212111,7 @@ stage: Modified - name: Modified6281 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1554", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -212119,7 +212119,7 @@ stage: Modified - name: Modified6282 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1555", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -212127,7 +212127,7 @@ stage: Modified - name: Modified6283 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1556", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -212135,7 +212135,7 @@ stage: Modified - name: Modified6284 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1557", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -212143,7 +212143,7 @@ stage: Modified - name: Modified6285 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1558", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -212151,7 +212151,7 @@ stage: Modified - name: Modified6286 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816991,"checksum":"7fe6a14ca1fe20614cba2deb3362084c7eda501f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"39b1051d662f240ce5ef63aabe902a1f2f29541a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1559", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -212159,7 +212159,7 @@ stage: Modified - name: Modified6287 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1568","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212179,7 +212179,7 @@ stage: Modified - name: Modified6288 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1569","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212199,7 +212199,7 @@ stage: Modified - name: Modified6289 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1570","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212219,7 +212219,7 @@ stage: Modified - name: Modified6290 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1571","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212239,7 +212239,7 @@ stage: Modified - name: Modified6291 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1572","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212259,7 +212259,7 @@ stage: Modified - name: Modified6292 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1573","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212279,7 +212279,7 @@ stage: Modified - name: Modified6293 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1574","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212299,7 +212299,7 @@ stage: Modified - name: Modified6294 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1575","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212319,7 +212319,7 @@ stage: Modified - name: Modified6295 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1584", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816992, @@ -212327,7 +212327,7 @@ stage: Modified - name: Modified6296 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1585", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816992, @@ -212335,7 +212335,7 @@ stage: Modified - name: Modified6297 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1586", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816992, @@ -212343,7 +212343,7 @@ stage: Modified - name: Modified6298 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1587", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816992, @@ -212351,7 +212351,7 @@ stage: Modified - name: Modified6299 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1588", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816992, @@ -212359,7 +212359,7 @@ stage: Modified - name: Modified6300 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1589", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816992, @@ -212367,7 +212367,7 @@ stage: Modified - name: Modified6301 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1590", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816992, @@ -212375,7 +212375,7 @@ stage: Modified - name: Modified6302 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816992,"checksum":"79a89df5fb5c58b26b610a951c8037da3e8554c5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723052,"checksum":"8664e64df52095d20f06a919fc6bd93db017ae71"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1591", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816992, @@ -212383,7 +212383,7 @@ stage: Modified - name: Modified6303 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1600","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212403,7 +212403,7 @@ stage: Modified - name: Modified6304 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1601","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212423,7 +212423,7 @@ stage: Modified - name: Modified6305 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1602","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212443,7 +212443,7 @@ stage: Modified - name: Modified6306 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1603","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212463,7 +212463,7 @@ stage: Modified - name: Modified6307 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1604","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212483,7 +212483,7 @@ stage: Modified - name: Modified6308 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1605","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212503,7 +212503,7 @@ stage: Modified - name: Modified6309 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1606","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212523,7 +212523,7 @@ stage: Modified - name: Modified6310 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1607","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212543,7 +212543,7 @@ stage: Modified - name: Modified6311 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1616", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -212551,7 +212551,7 @@ stage: Modified - name: Modified6312 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1617", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -212559,7 +212559,7 @@ stage: Modified - name: Modified6313 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1618", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -212567,7 +212567,7 @@ stage: Modified - name: Modified6314 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1619", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -212575,7 +212575,7 @@ stage: Modified - name: Modified6315 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1620", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -212583,7 +212583,7 @@ stage: Modified - name: Modified6316 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1621", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -212591,7 +212591,7 @@ stage: Modified - name: Modified6317 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1622", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -212599,7 +212599,7 @@ stage: Modified - name: Modified6318 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"efc320f738c3b6a7fd26e8e410de11b2780c12a7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723052,"checksum":"2ce7e0d98620233149076d35b501330f9ee39142"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1623", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -212607,7 +212607,7 @@ stage: Modified - name: Modified6319 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1632","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212626,7 +212626,7 @@ stage: Modified - name: Modified6320 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1633","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212645,7 +212645,7 @@ stage: Modified - name: Modified6321 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1634","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212664,7 +212664,7 @@ stage: Modified - name: Modified6322 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1635","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212683,7 +212683,7 @@ stage: Modified - name: Modified6323 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1636","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212702,7 +212702,7 @@ stage: Modified - name: Modified6324 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1637","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212721,7 +212721,7 @@ stage: Modified - name: Modified6325 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1638","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212740,7 +212740,7 @@ stage: Modified - name: Modified6326 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1639","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212759,63 +212759,63 @@ stage: Modified - name: Modified6327 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1648", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816992, "checksum": "20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"}}' stage: Modified - name: Modified6328 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1649", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816992, "checksum": "20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"}}' stage: Modified - name: Modified6329 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1650", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816992, "checksum": "20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"}}' stage: Modified - name: Modified6330 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1651", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816992, "checksum": "20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"}}' stage: Modified - name: Modified6331 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1652", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816992, "checksum": "20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"}}' stage: Modified - name: Modified6332 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1653", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816992, "checksum": "20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"}}' stage: Modified - name: Modified6333 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1654", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816992, "checksum": "20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"}}' stage: Modified - name: Modified6334 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816992,"checksum":"20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1655", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816992, "checksum": "20c1b5fdc5bd781701f0e38967ea4c45a6fc62fd"}}' stage: Modified - name: Modified6335 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1664","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212835,7 +212835,7 @@ stage: Modified - name: Modified6336 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1665","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212855,7 +212855,7 @@ stage: Modified - name: Modified6337 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1666","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212875,7 +212875,7 @@ stage: Modified - name: Modified6338 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1667","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212895,7 +212895,7 @@ stage: Modified - name: Modified6339 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1668","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212915,7 +212915,7 @@ stage: Modified - name: Modified6340 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1669","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212935,7 +212935,7 @@ stage: Modified - name: Modified6341 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1670","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212955,7 +212955,7 @@ stage: Modified - name: Modified6342 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1671","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -212975,7 +212975,7 @@ stage: Modified - name: Modified6343 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1680", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -212983,7 +212983,7 @@ stage: Modified - name: Modified6344 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1681", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -212991,7 +212991,7 @@ stage: Modified - name: Modified6345 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1682", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -212999,7 +212999,7 @@ stage: Modified - name: Modified6346 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1683", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213007,7 +213007,7 @@ stage: Modified - name: Modified6347 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1684", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213015,7 +213015,7 @@ stage: Modified - name: Modified6348 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1685", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213023,7 +213023,7 @@ stage: Modified - name: Modified6349 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1686", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213031,7 +213031,7 @@ stage: Modified - name: Modified6350 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816992,"checksum":"be28e292b004035f76bcebc76457df344693c6b2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1687", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213039,7 +213039,7 @@ stage: Modified - name: Modified6351 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1696","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213059,7 +213059,7 @@ stage: Modified - name: Modified6352 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1697","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213079,7 +213079,7 @@ stage: Modified - name: Modified6353 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1698","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213099,7 +213099,7 @@ stage: Modified - name: Modified6354 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1699","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213119,7 +213119,7 @@ stage: Modified - name: Modified6355 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1700","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213139,7 +213139,7 @@ stage: Modified - name: Modified6356 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1701","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213159,7 +213159,7 @@ stage: Modified - name: Modified6357 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1702","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213179,7 +213179,7 @@ stage: Modified - name: Modified6358 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1703","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213199,7 +213199,7 @@ stage: Modified - name: Modified6359 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1712", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -213207,7 +213207,7 @@ stage: Modified - name: Modified6360 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1713", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -213215,7 +213215,7 @@ stage: Modified - name: Modified6361 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1714", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -213223,7 +213223,7 @@ stage: Modified - name: Modified6362 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1715", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -213231,7 +213231,7 @@ stage: Modified - name: Modified6363 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1716", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -213239,7 +213239,7 @@ stage: Modified - name: Modified6364 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1717", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -213247,7 +213247,7 @@ stage: Modified - name: Modified6365 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1718", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -213255,7 +213255,7 @@ stage: Modified - name: Modified6366 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723053,"checksum":"44efebfe24e8d8855886e696f9019e25b5ac6f38"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1719", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -213263,7 +213263,7 @@ stage: Modified - name: Modified6367 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1728","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213283,7 +213283,7 @@ stage: Modified - name: Modified6368 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1729","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213303,7 +213303,7 @@ stage: Modified - name: Modified6369 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1730","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213323,7 +213323,7 @@ stage: Modified - name: Modified6370 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1731","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213343,7 +213343,7 @@ stage: Modified - name: Modified6371 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1732","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213363,7 +213363,7 @@ stage: Modified - name: Modified6372 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1733","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213383,7 +213383,7 @@ stage: Modified - name: Modified6373 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1734","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213403,7 +213403,7 @@ stage: Modified - name: Modified6374 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1735","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213423,7 +213423,7 @@ stage: Modified - name: Modified6375 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1744", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -213431,7 +213431,7 @@ stage: Modified - name: Modified6376 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1745", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -213439,7 +213439,7 @@ stage: Modified - name: Modified6377 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1746", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -213447,7 +213447,7 @@ stage: Modified - name: Modified6378 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1747", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -213455,7 +213455,7 @@ stage: Modified - name: Modified6379 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1748", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -213463,7 +213463,7 @@ stage: Modified - name: Modified6380 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1749", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -213471,7 +213471,7 @@ stage: Modified - name: Modified6381 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1750", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -213479,7 +213479,7 @@ stage: Modified - name: Modified6382 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"a0ce469c6dda808a7b3d39f3ca695026d56a9aa7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"3c5ef6fad25dcf370d06d3b8b39e0b01ef907964"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1751", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -213487,7 +213487,7 @@ stage: Modified - name: Modified6383 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1760","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213506,7 +213506,7 @@ stage: Modified - name: Modified6384 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1761","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213525,7 +213525,7 @@ stage: Modified - name: Modified6385 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1762","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213544,7 +213544,7 @@ stage: Modified - name: Modified6386 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1763","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213563,7 +213563,7 @@ stage: Modified - name: Modified6387 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1764","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213582,7 +213582,7 @@ stage: Modified - name: Modified6388 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1765","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213601,7 +213601,7 @@ stage: Modified - name: Modified6389 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1766","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213620,7 +213620,7 @@ stage: Modified - name: Modified6390 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1767","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213639,63 +213639,63 @@ stage: Modified - name: Modified6391 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1776", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816993, "checksum": "9d99ae62dd07b8d90fce253d4961fed7f4a60073"}}' stage: Modified - name: Modified6392 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1777", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816993, "checksum": "9d99ae62dd07b8d90fce253d4961fed7f4a60073"}}' stage: Modified - name: Modified6393 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1778", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816993, "checksum": "9d99ae62dd07b8d90fce253d4961fed7f4a60073"}}' stage: Modified - name: Modified6394 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1779", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816993, "checksum": "9d99ae62dd07b8d90fce253d4961fed7f4a60073"}}' stage: Modified - name: Modified6395 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1780", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816993, "checksum": "9d99ae62dd07b8d90fce253d4961fed7f4a60073"}}' stage: Modified - name: Modified6396 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1781", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816993, "checksum": "9d99ae62dd07b8d90fce253d4961fed7f4a60073"}}' stage: Modified - name: Modified6397 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1782", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816993, "checksum": "9d99ae62dd07b8d90fce253d4961fed7f4a60073"}}' stage: Modified - name: Modified6398 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","mtime":1606816993,"checksum":"9d99ae62dd07b8d90fce253d4961fed7f4a60073"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723053,"checksum":"a436eea6a887c4485684ddc11fd034e4af3542b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1783", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "mtime": 1606816993, "checksum": "9d99ae62dd07b8d90fce253d4961fed7f4a60073"}}' stage: Modified - name: Modified6399 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1792","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213715,7 +213715,7 @@ stage: Modified - name: Modified6400 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1793","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213735,7 +213735,7 @@ stage: Modified - name: Modified6401 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1794","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213755,7 +213755,7 @@ stage: Modified - name: Modified6402 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1795","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213775,7 +213775,7 @@ stage: Modified - name: Modified6403 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1796","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213795,7 +213795,7 @@ stage: Modified - name: Modified6404 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1797","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213815,7 +213815,7 @@ stage: Modified - name: Modified6405 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1798","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213835,7 +213835,7 @@ stage: Modified - name: Modified6406 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1799","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213855,7 +213855,7 @@ stage: Modified - name: Modified6407 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1808", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213863,7 +213863,7 @@ stage: Modified - name: Modified6408 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1809", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213871,7 +213871,7 @@ stage: Modified - name: Modified6409 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1810", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213879,7 +213879,7 @@ stage: Modified - name: Modified6410 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1811", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213887,7 +213887,7 @@ stage: Modified - name: Modified6411 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1812", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213895,7 +213895,7 @@ stage: Modified - name: Modified6412 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1813", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213903,7 +213903,7 @@ stage: Modified - name: Modified6413 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1814", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213911,7 +213911,7 @@ stage: Modified - name: Modified6414 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816993,"checksum":"2fc2cc90a3322f87d1d3143d834dd84c3fcb48fb"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723053,"checksum":"0f5a77429a38a9abec7305b99556f2b72fb5a0e5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1815", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -213919,7 +213919,7 @@ stage: Modified - name: Modified6415 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1824","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213939,7 +213939,7 @@ stage: Modified - name: Modified6416 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1825","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213959,7 +213959,7 @@ stage: Modified - name: Modified6417 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1826","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213979,7 +213979,7 @@ stage: Modified - name: Modified6418 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1827","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -213999,7 +213999,7 @@ stage: Modified - name: Modified6419 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1828","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214019,7 +214019,7 @@ stage: Modified - name: Modified6420 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1829","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214039,7 +214039,7 @@ stage: Modified - name: Modified6421 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1830","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214059,7 +214059,7 @@ stage: Modified - name: Modified6422 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1831","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214079,7 +214079,7 @@ stage: Modified - name: Modified6423 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1840", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -214087,7 +214087,7 @@ stage: Modified - name: Modified6424 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1841", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -214095,7 +214095,7 @@ stage: Modified - name: Modified6425 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1842", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -214103,7 +214103,7 @@ stage: Modified - name: Modified6426 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1843", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -214111,7 +214111,7 @@ stage: Modified - name: Modified6427 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816993,"checksum":"f9221e5736e102e4b5a76430db8bd1e69751a927"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1844", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816993, @@ -214119,7 +214119,7 @@ stage: Modified - name: Modified6428 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1845", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816994, @@ -214127,7 +214127,7 @@ stage: Modified - name: Modified6429 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1846", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816994, @@ -214135,7 +214135,7 @@ stage: Modified - name: Modified6430 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1847", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816994, @@ -214143,7 +214143,7 @@ stage: Modified - name: Modified6431 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1856","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214163,7 +214163,7 @@ stage: Modified - name: Modified6432 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1857","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214183,7 +214183,7 @@ stage: Modified - name: Modified6433 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1858","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214203,7 +214203,7 @@ stage: Modified - name: Modified6434 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1859","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214223,7 +214223,7 @@ stage: Modified - name: Modified6435 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1860","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214243,7 +214243,7 @@ stage: Modified - name: Modified6436 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1861","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214263,7 +214263,7 @@ stage: Modified - name: Modified6437 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1862","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214283,7 +214283,7 @@ stage: Modified - name: Modified6438 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1863","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214303,7 +214303,7 @@ stage: Modified - name: Modified6439 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1872", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -214311,7 +214311,7 @@ stage: Modified - name: Modified6440 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1873", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -214319,7 +214319,7 @@ stage: Modified - name: Modified6441 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1874", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -214327,7 +214327,7 @@ stage: Modified - name: Modified6442 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1875", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -214335,7 +214335,7 @@ stage: Modified - name: Modified6443 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1876", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -214343,7 +214343,7 @@ stage: Modified - name: Modified6444 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1877", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -214351,7 +214351,7 @@ stage: Modified - name: Modified6445 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1878", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -214359,7 +214359,7 @@ stage: Modified - name: Modified6446 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"439e2aee701b3527e0b2e3bc484ed70b6fb00094"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"b60f4f4a1af079c17052f28f5487b030558ff797"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1879", "arch": "[x64]", "timestamp": 1606863814, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -214367,7 +214367,7 @@ stage: Modified - name: Modified6447 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1888","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214386,7 +214386,7 @@ stage: Modified - name: Modified6448 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1889","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214405,7 +214405,7 @@ stage: Modified - name: Modified6449 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1890","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214424,7 +214424,7 @@ stage: Modified - name: Modified6450 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1891","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214443,7 +214443,7 @@ stage: Modified - name: Modified6451 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1892","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214462,7 +214462,7 @@ stage: Modified - name: Modified6452 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1893","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214481,7 +214481,7 @@ stage: Modified - name: Modified6453 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1894","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214500,7 +214500,7 @@ stage: Modified - name: Modified6454 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1895","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863814,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214519,63 +214519,63 @@ stage: Modified - name: Modified6455 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1904", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816994, "checksum": "31daae4d7b248f8b4b16b7df6e697540851a043c"}}' stage: Modified - name: Modified6456 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1905", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816994, "checksum": "31daae4d7b248f8b4b16b7df6e697540851a043c"}}' stage: Modified - name: Modified6457 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1906", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816994, "checksum": "31daae4d7b248f8b4b16b7df6e697540851a043c"}}' stage: Modified - name: Modified6458 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1907", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816994, "checksum": "31daae4d7b248f8b4b16b7df6e697540851a043c"}}' stage: Modified - name: Modified6459 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1908", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816994, "checksum": "31daae4d7b248f8b4b16b7df6e697540851a043c"}}' stage: Modified - name: Modified6460 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1909", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816994, "checksum": "31daae4d7b248f8b4b16b7df6e697540851a043c"}}' stage: Modified - name: Modified6461 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1910", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816994, "checksum": "31daae4d7b248f8b4b16b7df6e697540851a043c"}}' stage: Modified - name: Modified6462 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816994,"checksum":"31daae4d7b248f8b4b16b7df6e697540851a043c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723054,"checksum":"56780bb3600ebef1f0766ab4a68ca7232a852e39"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1911", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816994, "checksum": "31daae4d7b248f8b4b16b7df6e697540851a043c"}}' stage: Modified - name: Modified6463 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1920","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1920","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214595,7 +214595,7 @@ stage: Modified - name: Modified6464 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1921","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1921","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214615,7 +214615,7 @@ stage: Modified - name: Modified6465 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1922","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1922","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214635,7 +214635,7 @@ stage: Modified - name: Modified6466 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1923","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1923","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214655,7 +214655,7 @@ stage: Modified - name: Modified6467 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1924","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1924","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214675,7 +214675,7 @@ stage: Modified - name: Modified6468 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1925","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1925","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214695,7 +214695,7 @@ stage: Modified - name: Modified6469 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1926","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1926","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214715,7 +214715,7 @@ stage: Modified - name: Modified6470 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1927","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1927","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214735,7 +214735,7 @@ stage: Modified - name: Modified6471 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1936", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -214743,7 +214743,7 @@ stage: Modified - name: Modified6472 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1937", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -214751,7 +214751,7 @@ stage: Modified - name: Modified6473 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1938", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -214759,7 +214759,7 @@ stage: Modified - name: Modified6474 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1939", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -214767,7 +214767,7 @@ stage: Modified - name: Modified6475 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1940", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -214775,7 +214775,7 @@ stage: Modified - name: Modified6476 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1941", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -214783,7 +214783,7 @@ stage: Modified - name: Modified6477 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1942", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -214791,7 +214791,7 @@ stage: Modified - name: Modified6478 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816994,"checksum":"40f82b8aef9316d1d98b30edd59b45445ee3ac60"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723054,"checksum":"a6b7c5bcdafa24ebb49c7376e1ab2a0e948cc69b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1943", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -214799,7 +214799,7 @@ stage: Modified - name: Modified6479 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1952","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1952","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214819,7 +214819,7 @@ stage: Modified - name: Modified6480 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1953","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1953","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214839,7 +214839,7 @@ stage: Modified - name: Modified6481 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1954","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1954","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214859,7 +214859,7 @@ stage: Modified - name: Modified6482 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1955","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1955","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214879,7 +214879,7 @@ stage: Modified - name: Modified6483 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1956","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1956","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214899,7 +214899,7 @@ stage: Modified - name: Modified6484 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1957","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1957","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214919,7 +214919,7 @@ stage: Modified - name: Modified6485 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1958","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1958","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214939,7 +214939,7 @@ stage: Modified - name: Modified6486 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1959","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1959","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -214959,7 +214959,7 @@ stage: Modified - name: Modified6487 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1968", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816994, @@ -214967,7 +214967,7 @@ stage: Modified - name: Modified6488 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1969", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816994, @@ -214975,7 +214975,7 @@ stage: Modified - name: Modified6489 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1970", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816994, @@ -214983,7 +214983,7 @@ stage: Modified - name: Modified6490 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1971", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816994, @@ -214991,7 +214991,7 @@ stage: Modified - name: Modified6491 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1972", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816994, @@ -214999,7 +214999,7 @@ stage: Modified - name: Modified6492 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1973", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816994, @@ -215007,7 +215007,7 @@ stage: Modified - name: Modified6493 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1974", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816994, @@ -215015,7 +215015,7 @@ stage: Modified - name: Modified6494 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816994,"checksum":"3d4e7ac8a1432d54ab7866207755f7dab38bb430"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723054,"checksum":"8c740567e95bf57fc0e2c86ea750bfaa8f6bff42"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1975", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816994, @@ -215023,7 +215023,7 @@ stage: Modified - name: Modified6495 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1984","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1984","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215043,7 +215043,7 @@ stage: Modified - name: Modified6496 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1985","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1985","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215063,7 +215063,7 @@ stage: Modified - name: Modified6497 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1986","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1986","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215083,7 +215083,7 @@ stage: Modified - name: Modified6498 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1987","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1987","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215103,7 +215103,7 @@ stage: Modified - name: Modified6499 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1988","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1988","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215123,7 +215123,7 @@ stage: Modified - name: Modified6500 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1989","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1989","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215143,7 +215143,7 @@ stage: Modified - name: Modified6501 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1990","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1990","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215163,7 +215163,7 @@ stage: Modified - name: Modified6502 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1991","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1991","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215183,7 +215183,7 @@ stage: Modified - name: Modified6503 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2000", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -215191,7 +215191,7 @@ stage: Modified - name: Modified6504 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2001", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -215199,7 +215199,7 @@ stage: Modified - name: Modified6505 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2002", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -215207,7 +215207,7 @@ stage: Modified - name: Modified6506 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2003", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -215215,7 +215215,7 @@ stage: Modified - name: Modified6507 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2004", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -215223,7 +215223,7 @@ stage: Modified - name: Modified6508 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2005", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -215231,7 +215231,7 @@ stage: Modified - name: Modified6509 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2006", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -215239,7 +215239,7 @@ stage: Modified - name: Modified6510 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"297e8f8fb7c7dfa24901563f5c910db202edf023"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2007", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -215247,7 +215247,7 @@ stage: Modified - name: Modified6511 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2016","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2016","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215266,7 +215266,7 @@ stage: Modified - name: Modified6512 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2017","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2017","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215285,7 +215285,7 @@ stage: Modified - name: Modified6513 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2018","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2018","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215304,7 +215304,7 @@ stage: Modified - name: Modified6514 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2019","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2019","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215323,7 +215323,7 @@ stage: Modified - name: Modified6515 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2020","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2020","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215342,7 +215342,7 @@ stage: Modified - name: Modified6516 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2021","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2021","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215361,7 +215361,7 @@ stage: Modified - name: Modified6517 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2022","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2022","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215380,7 +215380,7 @@ stage: Modified - name: Modified6518 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2023","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2023","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215399,63 +215399,63 @@ stage: Modified - name: Modified6519 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2032", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816995, "checksum": "dced96f77c921a892d837f9882ee595e9346b715"}}' stage: Modified - name: Modified6520 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2033", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816995, "checksum": "dced96f77c921a892d837f9882ee595e9346b715"}}' stage: Modified - name: Modified6521 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2034", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816995, "checksum": "dced96f77c921a892d837f9882ee595e9346b715"}}' stage: Modified - name: Modified6522 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2035", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816995, "checksum": "dced96f77c921a892d837f9882ee595e9346b715"}}' stage: Modified - name: Modified6523 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2036", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816995, "checksum": "dced96f77c921a892d837f9882ee595e9346b715"}}' stage: Modified - name: Modified6524 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2037", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816995, "checksum": "dced96f77c921a892d837f9882ee595e9346b715"}}' stage: Modified - name: Modified6525 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2038", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816995, "checksum": "dced96f77c921a892d837f9882ee595e9346b715"}}' stage: Modified - name: Modified6526 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816995,"checksum":"dced96f77c921a892d837f9882ee595e9346b715"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2039", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816995, "checksum": "dced96f77c921a892d837f9882ee595e9346b715"}}' stage: Modified - name: Modified6527 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2048","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215475,7 +215475,7 @@ stage: Modified - name: Modified6528 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2049","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215495,7 +215495,7 @@ stage: Modified - name: Modified6529 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2050","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215515,7 +215515,7 @@ stage: Modified - name: Modified6530 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2051","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215535,7 +215535,7 @@ stage: Modified - name: Modified6531 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2052","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215555,7 +215555,7 @@ stage: Modified - name: Modified6532 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2053","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215575,7 +215575,7 @@ stage: Modified - name: Modified6533 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2054","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215595,7 +215595,7 @@ stage: Modified - name: Modified6534 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2055","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215615,7 +215615,7 @@ stage: Modified - name: Modified6535 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2064", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -215623,7 +215623,7 @@ stage: Modified - name: Modified6536 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2065", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -215631,7 +215631,7 @@ stage: Modified - name: Modified6537 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2066", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -215639,7 +215639,7 @@ stage: Modified - name: Modified6538 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2067", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -215647,7 +215647,7 @@ stage: Modified - name: Modified6539 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2068", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -215655,7 +215655,7 @@ stage: Modified - name: Modified6540 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2069", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -215663,7 +215663,7 @@ stage: Modified - name: Modified6541 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2070", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -215671,7 +215671,7 @@ stage: Modified - name: Modified6542 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816995,"checksum":"e26791f5eb8d9dc98123c19de9caf4e7f8f4db29"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"526d09bb5709fd81fdd0cfcd5cf8f42a6599f1b9"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2071", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -215679,7 +215679,7 @@ stage: Modified - name: Modified6543 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2080","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215699,7 +215699,7 @@ stage: Modified - name: Modified6544 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2081","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215719,7 +215719,7 @@ stage: Modified - name: Modified6545 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2082","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215739,7 +215739,7 @@ stage: Modified - name: Modified6546 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2083","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215759,7 +215759,7 @@ stage: Modified - name: Modified6547 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2084","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215779,7 +215779,7 @@ stage: Modified - name: Modified6548 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2085","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215799,7 +215799,7 @@ stage: Modified - name: Modified6549 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2086","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215819,7 +215819,7 @@ stage: Modified - name: Modified6550 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2087","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215839,7 +215839,7 @@ stage: Modified - name: Modified6551 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2096", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816995, @@ -215847,7 +215847,7 @@ stage: Modified - name: Modified6552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2097", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816995, @@ -215855,7 +215855,7 @@ stage: Modified - name: Modified6553 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2098", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816995, @@ -215863,7 +215863,7 @@ stage: Modified - name: Modified6554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2099", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816995, @@ -215871,7 +215871,7 @@ stage: Modified - name: Modified6555 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2100", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816995, @@ -215879,7 +215879,7 @@ stage: Modified - name: Modified6556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2101", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816995, @@ -215887,7 +215887,7 @@ stage: Modified - name: Modified6557 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2102", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816995, @@ -215895,7 +215895,7 @@ stage: Modified - name: Modified6558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816995,"checksum":"2156f0e5e91e7c4e8d25b07331d3fa14c7decce0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723055,"checksum":"117cfa53ada01df5894402036fb5363050f2bfef"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2103", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816995, @@ -215903,7 +215903,7 @@ stage: Modified - name: Modified6559 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2112","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215923,7 +215923,7 @@ stage: Modified - name: Modified6560 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2113","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215943,7 +215943,7 @@ stage: Modified - name: Modified6561 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2114","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215963,7 +215963,7 @@ stage: Modified - name: Modified6562 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2115","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -215983,7 +215983,7 @@ stage: Modified - name: Modified6563 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2116","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216003,7 +216003,7 @@ stage: Modified - name: Modified6564 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2117","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216023,7 +216023,7 @@ stage: Modified - name: Modified6565 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2118","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216043,7 +216043,7 @@ stage: Modified - name: Modified6566 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2119","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216063,7 +216063,7 @@ stage: Modified - name: Modified6567 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2128", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216071,7 +216071,7 @@ stage: Modified - name: Modified6568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2129", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216079,7 +216079,7 @@ stage: Modified - name: Modified6569 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2130", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216087,7 +216087,7 @@ stage: Modified - name: Modified6570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2131", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216095,7 +216095,7 @@ stage: Modified - name: Modified6571 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2132", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216103,7 +216103,7 @@ stage: Modified - name: Modified6572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2133", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216111,7 +216111,7 @@ stage: Modified - name: Modified6573 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2134", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216119,7 +216119,7 @@ stage: Modified - name: Modified6574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f4b7aa75f93b6ecdd0089d4af37fd0f267286d82"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723055,"checksum":"612222a22268d31905386d02c92fbb1f17a15cda"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2135", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216127,7 +216127,7 @@ stage: Modified - name: Modified6575 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2144","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216146,7 +216146,7 @@ stage: Modified - name: Modified6576 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2145","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216165,7 +216165,7 @@ stage: Modified - name: Modified6577 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2146","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216184,7 +216184,7 @@ stage: Modified - name: Modified6578 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2147","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216203,7 +216203,7 @@ stage: Modified - name: Modified6579 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2148","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216222,7 +216222,7 @@ stage: Modified - name: Modified6580 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2149","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216241,7 +216241,7 @@ stage: Modified - name: Modified6581 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2150","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216260,7 +216260,7 @@ stage: Modified - name: Modified6582 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2151","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216279,63 +216279,63 @@ stage: Modified - name: Modified6583 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2160", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816996, "checksum": "30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"}}' stage: Modified - name: Modified6584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2161", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816996, "checksum": "30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"}}' stage: Modified - name: Modified6585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2162", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816996, "checksum": "30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"}}' stage: Modified - name: Modified6586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2163", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816996, "checksum": "30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"}}' stage: Modified - name: Modified6587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2164", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816996, "checksum": "30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"}}' stage: Modified - name: Modified6588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2165", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816996, "checksum": "30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"}}' stage: Modified - name: Modified6589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2166", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816996, "checksum": "30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"}}' stage: Modified - name: Modified6590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816996,"checksum":"30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723055,"checksum":"a8e24fcbe7df1a045e47dc687cd9666c7e32d080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2167", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816996, "checksum": "30c37c83d49fc3936f1d032cc0e21c191d8c2e7f"}}' stage: Modified - name: Modified6591 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2176","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216355,7 +216355,7 @@ stage: Modified - name: Modified6592 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2177","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216375,7 +216375,7 @@ stage: Modified - name: Modified6593 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2178","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216395,7 +216395,7 @@ stage: Modified - name: Modified6594 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2179","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216415,7 +216415,7 @@ stage: Modified - name: Modified6595 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2180","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216435,7 +216435,7 @@ stage: Modified - name: Modified6596 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2181","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216455,7 +216455,7 @@ stage: Modified - name: Modified6597 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2182","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216475,7 +216475,7 @@ stage: Modified - name: Modified6598 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2183","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216495,7 +216495,7 @@ stage: Modified - name: Modified6599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2192", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -216503,7 +216503,7 @@ stage: Modified - name: Modified6600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2193", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -216511,7 +216511,7 @@ stage: Modified - name: Modified6601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2194", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -216519,7 +216519,7 @@ stage: Modified - name: Modified6602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2195", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -216527,7 +216527,7 @@ stage: Modified - name: Modified6603 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2196", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -216535,7 +216535,7 @@ stage: Modified - name: Modified6604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2197", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -216543,7 +216543,7 @@ stage: Modified - name: Modified6605 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2198", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -216551,7 +216551,7 @@ stage: Modified - name: Modified6606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816996,"checksum":"f878cca7b428f2e8c999f3da230280f6e1e29623"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2199", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -216559,7 +216559,7 @@ stage: Modified - name: Modified6607 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2208","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216579,7 +216579,7 @@ stage: Modified - name: Modified6608 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2209","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216599,7 +216599,7 @@ stage: Modified - name: Modified6609 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2210","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216619,7 +216619,7 @@ stage: Modified - name: Modified6610 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2211","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216639,7 +216639,7 @@ stage: Modified - name: Modified6611 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2212","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216659,7 +216659,7 @@ stage: Modified - name: Modified6612 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2213","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216679,7 +216679,7 @@ stage: Modified - name: Modified6613 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2214","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216699,7 +216699,7 @@ stage: Modified - name: Modified6614 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2215","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216719,7 +216719,7 @@ stage: Modified - name: Modified6615 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2224", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816996, @@ -216727,7 +216727,7 @@ stage: Modified - name: Modified6616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2225", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816996, @@ -216735,7 +216735,7 @@ stage: Modified - name: Modified6617 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2226", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816996, @@ -216743,7 +216743,7 @@ stage: Modified - name: Modified6618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2227", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816996, @@ -216751,7 +216751,7 @@ stage: Modified - name: Modified6619 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2228", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816996, @@ -216759,7 +216759,7 @@ stage: Modified - name: Modified6620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2229", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816996, @@ -216767,7 +216767,7 @@ stage: Modified - name: Modified6621 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2230", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816996, @@ -216775,7 +216775,7 @@ stage: Modified - name: Modified6622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816996,"checksum":"3073f1b7ae7ccff15740233f0ba114f25de6c94b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723056,"checksum":"d7ae0fdaba961e5d054ea3c7cef122bbe4405aa6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2231", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816996, @@ -216783,7 +216783,7 @@ stage: Modified - name: Modified6623 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2240","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216803,7 +216803,7 @@ stage: Modified - name: Modified6624 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2241","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216823,7 +216823,7 @@ stage: Modified - name: Modified6625 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2242","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216843,7 +216843,7 @@ stage: Modified - name: Modified6626 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2243","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216863,7 +216863,7 @@ stage: Modified - name: Modified6627 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2244","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216883,7 +216883,7 @@ stage: Modified - name: Modified6628 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2245","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216903,7 +216903,7 @@ stage: Modified - name: Modified6629 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2246","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216923,7 +216923,7 @@ stage: Modified - name: Modified6630 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2247","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -216943,7 +216943,7 @@ stage: Modified - name: Modified6631 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2256", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216951,7 +216951,7 @@ stage: Modified - name: Modified6632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2257", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216959,7 +216959,7 @@ stage: Modified - name: Modified6633 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2258", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216967,7 +216967,7 @@ stage: Modified - name: Modified6634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2259", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216975,7 +216975,7 @@ stage: Modified - name: Modified6635 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2260", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216983,7 +216983,7 @@ stage: Modified - name: Modified6636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2261", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216991,7 +216991,7 @@ stage: Modified - name: Modified6637 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2262", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -216999,7 +216999,7 @@ stage: Modified - name: Modified6638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"3f7de9a99b690435ac791e6da21345e766c127ab"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"de4a0391bffae169627d84f0ecddad38ff5f7816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2263", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -217007,7 +217007,7 @@ stage: Modified - name: Modified6639 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2272","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217026,7 +217026,7 @@ stage: Modified - name: Modified6640 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2273","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217045,7 +217045,7 @@ stage: Modified - name: Modified6641 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2274","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217064,7 +217064,7 @@ stage: Modified - name: Modified6642 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2275","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217083,7 +217083,7 @@ stage: Modified - name: Modified6643 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2276","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217102,7 +217102,7 @@ stage: Modified - name: Modified6644 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2277","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217121,7 +217121,7 @@ stage: Modified - name: Modified6645 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2278","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217140,7 +217140,7 @@ stage: Modified - name: Modified6646 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2279","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217159,63 +217159,63 @@ stage: Modified - name: Modified6647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2288", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816997, "checksum": "502622073633c36d4b87d0a86982411315426f25"}}' stage: Modified - name: Modified6648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2289", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816997, "checksum": "502622073633c36d4b87d0a86982411315426f25"}}' stage: Modified - name: Modified6649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2290", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816997, "checksum": "502622073633c36d4b87d0a86982411315426f25"}}' stage: Modified - name: Modified6650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2291", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816997, "checksum": "502622073633c36d4b87d0a86982411315426f25"}}' stage: Modified - name: Modified6651 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2292", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816997, "checksum": "502622073633c36d4b87d0a86982411315426f25"}}' stage: Modified - name: Modified6652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2293", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816997, "checksum": "502622073633c36d4b87d0a86982411315426f25"}}' stage: Modified - name: Modified6653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2294", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816997, "checksum": "502622073633c36d4b87d0a86982411315426f25"}}' stage: Modified - name: Modified6654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","mtime":1606816997,"checksum":"502622073633c36d4b87d0a86982411315426f25"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723056,"checksum":"642d233ae9698f821a7b1afee207c9abaca21320"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2295", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "mtime": 1606816997, "checksum": "502622073633c36d4b87d0a86982411315426f25"}}' stage: Modified - name: Modified6655 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2304","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217235,7 +217235,7 @@ stage: Modified - name: Modified6656 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2305","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217255,7 +217255,7 @@ stage: Modified - name: Modified6657 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2306","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217275,7 +217275,7 @@ stage: Modified - name: Modified6658 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2307","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217295,7 +217295,7 @@ stage: Modified - name: Modified6659 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2308","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217315,7 +217315,7 @@ stage: Modified - name: Modified6660 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2309","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217335,7 +217335,7 @@ stage: Modified - name: Modified6661 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2310","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217355,7 +217355,7 @@ stage: Modified - name: Modified6662 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2311","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217375,7 +217375,7 @@ stage: Modified - name: Modified6663 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2320", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -217383,7 +217383,7 @@ stage: Modified - name: Modified6664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2321", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -217391,7 +217391,7 @@ stage: Modified - name: Modified6665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2322", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -217399,7 +217399,7 @@ stage: Modified - name: Modified6666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2323", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -217407,7 +217407,7 @@ stage: Modified - name: Modified6667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2324", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -217415,7 +217415,7 @@ stage: Modified - name: Modified6668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2325", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -217423,7 +217423,7 @@ stage: Modified - name: Modified6669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2326", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -217431,7 +217431,7 @@ stage: Modified - name: Modified6670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816997,"checksum":"888861337c1f97e28dcf7d6b58b7f16b37cd7fe2"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723056,"checksum":"86a9825bcb637491c5fe1dfb6a971c27817b9b53"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2327", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -217439,7 +217439,7 @@ stage: Modified - name: Modified6671 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2336","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217459,7 +217459,7 @@ stage: Modified - name: Modified6672 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2337","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217479,7 +217479,7 @@ stage: Modified - name: Modified6673 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2338","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217499,7 +217499,7 @@ stage: Modified - name: Modified6674 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2339","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217519,7 +217519,7 @@ stage: Modified - name: Modified6675 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2340","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217539,7 +217539,7 @@ stage: Modified - name: Modified6676 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2341","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217559,7 +217559,7 @@ stage: Modified - name: Modified6677 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2342","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217579,7 +217579,7 @@ stage: Modified - name: Modified6678 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2343","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217599,7 +217599,7 @@ stage: Modified - name: Modified6679 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2352", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816997, @@ -217607,7 +217607,7 @@ stage: Modified - name: Modified6680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2353", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816997, @@ -217615,7 +217615,7 @@ stage: Modified - name: Modified6681 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2354", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816997, @@ -217623,7 +217623,7 @@ stage: Modified - name: Modified6682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2355", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816997, @@ -217631,7 +217631,7 @@ stage: Modified - name: Modified6683 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2356", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816997, @@ -217639,7 +217639,7 @@ stage: Modified - name: Modified6684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2357", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816997, @@ -217647,7 +217647,7 @@ stage: Modified - name: Modified6685 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2358", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816997, @@ -217655,7 +217655,7 @@ stage: Modified - name: Modified6686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863815,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816997,"checksum":"918025d324fd3b2cec943b4a7e09375f12eee539"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2359", "arch": "[x64]", "timestamp": 1606863815, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816997, @@ -217663,7 +217663,7 @@ stage: Modified - name: Modified6687 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2368","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217683,7 +217683,7 @@ stage: Modified - name: Modified6688 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2369","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217703,7 +217703,7 @@ stage: Modified - name: Modified6689 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2370","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217723,7 +217723,7 @@ stage: Modified - name: Modified6690 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2371","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217743,7 +217743,7 @@ stage: Modified - name: Modified6691 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2372","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217763,7 +217763,7 @@ stage: Modified - name: Modified6692 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2373","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217783,7 +217783,7 @@ stage: Modified - name: Modified6693 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2374","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217803,7 +217803,7 @@ stage: Modified - name: Modified6694 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2375","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217823,7 +217823,7 @@ stage: Modified - name: Modified6695 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2384", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -217831,7 +217831,7 @@ stage: Modified - name: Modified6696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2385", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -217839,7 +217839,7 @@ stage: Modified - name: Modified6697 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2386", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -217847,7 +217847,7 @@ stage: Modified - name: Modified6698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2387", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -217855,7 +217855,7 @@ stage: Modified - name: Modified6699 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2388", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -217863,7 +217863,7 @@ stage: Modified - name: Modified6700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2389", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -217871,7 +217871,7 @@ stage: Modified - name: Modified6701 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2390", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -217879,7 +217879,7 @@ stage: Modified - name: Modified6702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2391", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -217887,7 +217887,7 @@ stage: Modified - name: Modified6703 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2400","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217906,7 +217906,7 @@ stage: Modified - name: Modified6704 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2401","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217925,7 +217925,7 @@ stage: Modified - name: Modified6705 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2402","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217944,7 +217944,7 @@ stage: Modified - name: Modified6706 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2403","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217963,7 +217963,7 @@ stage: Modified - name: Modified6707 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2404","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -217982,7 +217982,7 @@ stage: Modified - name: Modified6708 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2405","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218001,7 +218001,7 @@ stage: Modified - name: Modified6709 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2406","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218020,7 +218020,7 @@ stage: Modified - name: Modified6710 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2407","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218039,63 +218039,63 @@ stage: Modified - name: Modified6711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2416", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816998, "checksum": "657c0309e880999fefa93132fe0c90da3b784f36"}}' stage: Modified - name: Modified6712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2417", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816998, "checksum": "657c0309e880999fefa93132fe0c90da3b784f36"}}' stage: Modified - name: Modified6713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2418", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816998, "checksum": "657c0309e880999fefa93132fe0c90da3b784f36"}}' stage: Modified - name: Modified6714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2419", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816998, "checksum": "657c0309e880999fefa93132fe0c90da3b784f36"}}' stage: Modified - name: Modified6715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2420", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816998, "checksum": "657c0309e880999fefa93132fe0c90da3b784f36"}}' stage: Modified - name: Modified6716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2421", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816998, "checksum": "657c0309e880999fefa93132fe0c90da3b784f36"}}' stage: Modified - name: Modified6717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2422", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816998, "checksum": "657c0309e880999fefa93132fe0c90da3b784f36"}}' stage: Modified - name: Modified6718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816998,"checksum":"657c0309e880999fefa93132fe0c90da3b784f36"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723057,"checksum":"551ed7b7e8e4a448f1e269d0813358604c044ab8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2423", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816998, "checksum": "657c0309e880999fefa93132fe0c90da3b784f36"}}' stage: Modified - name: Modified6719 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2432","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218115,7 +218115,7 @@ stage: Modified - name: Modified6720 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2433","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218135,7 +218135,7 @@ stage: Modified - name: Modified6721 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2434","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218155,7 +218155,7 @@ stage: Modified - name: Modified6722 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2435","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218175,7 +218175,7 @@ stage: Modified - name: Modified6723 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2436","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218195,7 +218195,7 @@ stage: Modified - name: Modified6724 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2437","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218215,7 +218215,7 @@ stage: Modified - name: Modified6725 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2438","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218235,7 +218235,7 @@ stage: Modified - name: Modified6726 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2439","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218255,7 +218255,7 @@ stage: Modified - name: Modified6727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2448", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -218263,7 +218263,7 @@ stage: Modified - name: Modified6728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2449", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -218271,7 +218271,7 @@ stage: Modified - name: Modified6729 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2450", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -218279,7 +218279,7 @@ stage: Modified - name: Modified6730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2451", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -218287,7 +218287,7 @@ stage: Modified - name: Modified6731 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2452", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -218295,7 +218295,7 @@ stage: Modified - name: Modified6732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2453", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -218303,7 +218303,7 @@ stage: Modified - name: Modified6733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2454", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -218311,7 +218311,7 @@ stage: Modified - name: Modified6734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"669ce78a10d44213361d9c3c2c6221d90c139c08"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"430ab9e3d00c7d58f6d67ad47a0683b5e2588064"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2455", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -218319,7 +218319,7 @@ stage: Modified - name: Modified6735 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2464","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218339,7 +218339,7 @@ stage: Modified - name: Modified6736 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2465","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218359,7 +218359,7 @@ stage: Modified - name: Modified6737 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2466","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218379,7 +218379,7 @@ stage: Modified - name: Modified6738 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2467","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218399,7 +218399,7 @@ stage: Modified - name: Modified6739 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2468","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218419,7 +218419,7 @@ stage: Modified - name: Modified6740 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2469","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218439,7 +218439,7 @@ stage: Modified - name: Modified6741 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2470","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218459,7 +218459,7 @@ stage: Modified - name: Modified6742 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2471","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218479,7 +218479,7 @@ stage: Modified - name: Modified6743 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2480", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816998, @@ -218487,7 +218487,7 @@ stage: Modified - name: Modified6744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2481", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816998, @@ -218495,7 +218495,7 @@ stage: Modified - name: Modified6745 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2482", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816998, @@ -218503,7 +218503,7 @@ stage: Modified - name: Modified6746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2483", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816998, @@ -218511,7 +218511,7 @@ stage: Modified - name: Modified6747 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2484", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816998, @@ -218519,7 +218519,7 @@ stage: Modified - name: Modified6748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2485", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816998, @@ -218527,7 +218527,7 @@ stage: Modified - name: Modified6749 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2486", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816998, @@ -218535,7 +218535,7 @@ stage: Modified - name: Modified6750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816998,"checksum":"217467851cc6893921307da84dd973932e1a48e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723057,"checksum":"65a8db0f2a283c004c26be4dfed8d7538b686474"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2487", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816998, @@ -218543,7 +218543,7 @@ stage: Modified - name: Modified6751 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2496","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218563,7 +218563,7 @@ stage: Modified - name: Modified6752 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2497","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218583,7 +218583,7 @@ stage: Modified - name: Modified6753 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2498","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218603,7 +218603,7 @@ stage: Modified - name: Modified6754 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2499","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218623,7 +218623,7 @@ stage: Modified - name: Modified6755 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2500","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218643,7 +218643,7 @@ stage: Modified - name: Modified6756 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2501","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218663,7 +218663,7 @@ stage: Modified - name: Modified6757 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2502","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218683,7 +218683,7 @@ stage: Modified - name: Modified6758 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2503","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218703,7 +218703,7 @@ stage: Modified - name: Modified6759 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2512", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -218711,7 +218711,7 @@ stage: Modified - name: Modified6760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2513", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -218719,7 +218719,7 @@ stage: Modified - name: Modified6761 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2514", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -218727,7 +218727,7 @@ stage: Modified - name: Modified6762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816998,"checksum":"cbc381cc0b82223e6887daa6c3a5d5cd987884b8"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2515", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -218735,7 +218735,7 @@ stage: Modified - name: Modified6763 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2516", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -218743,7 +218743,7 @@ stage: Modified - name: Modified6764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2517", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -218751,7 +218751,7 @@ stage: Modified - name: Modified6765 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2518", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -218759,7 +218759,7 @@ stage: Modified - name: Modified6766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723057,"checksum":"f619054e3faa49d7b10972ae0b8fcc64006cfc06"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2519", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -218767,7 +218767,7 @@ stage: Modified - name: Modified6767 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2528","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218786,7 +218786,7 @@ stage: Modified - name: Modified6768 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2529","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218805,7 +218805,7 @@ stage: Modified - name: Modified6769 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2530","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218824,7 +218824,7 @@ stage: Modified - name: Modified6770 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2531","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218843,7 +218843,7 @@ stage: Modified - name: Modified6771 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2532","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218862,7 +218862,7 @@ stage: Modified - name: Modified6772 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2533","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218881,7 +218881,7 @@ stage: Modified - name: Modified6773 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2534","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218900,7 +218900,7 @@ stage: Modified - name: Modified6774 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2535","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218919,63 +218919,63 @@ stage: Modified - name: Modified6775 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2544", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816999, "checksum": "787dacae5b1f798fb4707a30a6ab699a71844743"}}' stage: Modified - name: Modified6776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2545", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816999, "checksum": "787dacae5b1f798fb4707a30a6ab699a71844743"}}' stage: Modified - name: Modified6777 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2546", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816999, "checksum": "787dacae5b1f798fb4707a30a6ab699a71844743"}}' stage: Modified - name: Modified6778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2547", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816999, "checksum": "787dacae5b1f798fb4707a30a6ab699a71844743"}}' stage: Modified - name: Modified6779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2548", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816999, "checksum": "787dacae5b1f798fb4707a30a6ab699a71844743"}}' stage: Modified - name: Modified6780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2549", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816999, "checksum": "787dacae5b1f798fb4707a30a6ab699a71844743"}}' stage: Modified - name: Modified6781 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2550", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816999, "checksum": "787dacae5b1f798fb4707a30a6ab699a71844743"}}' stage: Modified - name: Modified6782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606816999,"checksum":"787dacae5b1f798fb4707a30a6ab699a71844743"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2551", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606816999, "checksum": "787dacae5b1f798fb4707a30a6ab699a71844743"}}' stage: Modified - name: Modified6783 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2560","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -218995,7 +218995,7 @@ stage: Modified - name: Modified6784 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2561","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219015,7 +219015,7 @@ stage: Modified - name: Modified6785 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2562","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219035,7 +219035,7 @@ stage: Modified - name: Modified6786 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2563","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219055,7 +219055,7 @@ stage: Modified - name: Modified6787 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2564","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219075,7 +219075,7 @@ stage: Modified - name: Modified6788 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2565","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219095,7 +219095,7 @@ stage: Modified - name: Modified6789 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2566","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219115,7 +219115,7 @@ stage: Modified - name: Modified6790 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2567","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219135,7 +219135,7 @@ stage: Modified - name: Modified6791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2576", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -219143,7 +219143,7 @@ stage: Modified - name: Modified6792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2577", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -219151,7 +219151,7 @@ stage: Modified - name: Modified6793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2578", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -219159,7 +219159,7 @@ stage: Modified - name: Modified6794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2579", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -219167,7 +219167,7 @@ stage: Modified - name: Modified6795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2580", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -219175,7 +219175,7 @@ stage: Modified - name: Modified6796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2581", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -219183,7 +219183,7 @@ stage: Modified - name: Modified6797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2582", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -219191,7 +219191,7 @@ stage: Modified - name: Modified6798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"0fe78bb73475e42d239167c7bce2d4ed9f8f09bd"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2583", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -219199,7 +219199,7 @@ stage: Modified - name: Modified6799 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2592","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219219,7 +219219,7 @@ stage: Modified - name: Modified6800 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2593","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219239,7 +219239,7 @@ stage: Modified - name: Modified6801 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2594","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219259,7 +219259,7 @@ stage: Modified - name: Modified6802 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2595","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219279,7 +219279,7 @@ stage: Modified - name: Modified6803 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2596","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219299,7 +219299,7 @@ stage: Modified - name: Modified6804 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2597","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219319,7 +219319,7 @@ stage: Modified - name: Modified6805 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2598","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219339,7 +219339,7 @@ stage: Modified - name: Modified6806 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2599","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219359,7 +219359,7 @@ stage: Modified - name: Modified6807 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2608", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816999, @@ -219367,7 +219367,7 @@ stage: Modified - name: Modified6808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2609", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816999, @@ -219375,7 +219375,7 @@ stage: Modified - name: Modified6809 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2610", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816999, @@ -219383,7 +219383,7 @@ stage: Modified - name: Modified6810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2611", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816999, @@ -219391,7 +219391,7 @@ stage: Modified - name: Modified6811 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2612", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816999, @@ -219399,7 +219399,7 @@ stage: Modified - name: Modified6812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2613", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816999, @@ -219407,7 +219407,7 @@ stage: Modified - name: Modified6813 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2614", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816999, @@ -219415,7 +219415,7 @@ stage: Modified - name: Modified6814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606816999,"checksum":"d90d782cf4f390e7d81e2a6861da773e19d68cbe"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723058,"checksum":"c2af67d4712ae7599b862226d1fc659155497d77"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2615", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606816999, @@ -219423,7 +219423,7 @@ stage: Modified - name: Modified6815 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2624","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219443,7 +219443,7 @@ stage: Modified - name: Modified6816 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2625","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219463,7 +219463,7 @@ stage: Modified - name: Modified6817 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2626","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219483,7 +219483,7 @@ stage: Modified - name: Modified6818 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2627","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219503,7 +219503,7 @@ stage: Modified - name: Modified6819 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2628","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219523,7 +219523,7 @@ stage: Modified - name: Modified6820 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2629","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219543,7 +219543,7 @@ stage: Modified - name: Modified6821 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2630","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219563,7 +219563,7 @@ stage: Modified - name: Modified6822 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2631","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219583,7 +219583,7 @@ stage: Modified - name: Modified6823 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2640", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -219591,7 +219591,7 @@ stage: Modified - name: Modified6824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2641", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -219599,7 +219599,7 @@ stage: Modified - name: Modified6825 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2642", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -219607,7 +219607,7 @@ stage: Modified - name: Modified6826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2643", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -219615,7 +219615,7 @@ stage: Modified - name: Modified6827 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2644", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -219623,7 +219623,7 @@ stage: Modified - name: Modified6828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2645", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -219631,7 +219631,7 @@ stage: Modified - name: Modified6829 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2646", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -219639,7 +219639,7 @@ stage: Modified - name: Modified6830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606816999,"checksum":"81e0265a0cad8ce4f066a9bfd9055d1434095907"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"4da6f34f747871294a6bb49933e627c2d171c701"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2647", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -219647,7 +219647,7 @@ stage: Modified - name: Modified6831 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2656","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219666,7 +219666,7 @@ stage: Modified - name: Modified6832 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2657","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219685,7 +219685,7 @@ stage: Modified - name: Modified6833 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2658","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219704,7 +219704,7 @@ stage: Modified - name: Modified6834 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2659","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219723,7 +219723,7 @@ stage: Modified - name: Modified6835 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2660","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219742,7 +219742,7 @@ stage: Modified - name: Modified6836 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2661","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219761,7 +219761,7 @@ stage: Modified - name: Modified6837 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2662","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219780,7 +219780,7 @@ stage: Modified - name: Modified6838 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2663","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219799,63 +219799,63 @@ stage: Modified - name: Modified6839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2672", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606817000, "checksum": "55ab0b3458381b69a6540dae272dbd3e54c956ad"}}' stage: Modified - name: Modified6840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2673", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606817000, "checksum": "55ab0b3458381b69a6540dae272dbd3e54c956ad"}}' stage: Modified - name: Modified6841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2674", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606817000, "checksum": "55ab0b3458381b69a6540dae272dbd3e54c956ad"}}' stage: Modified - name: Modified6842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2675", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606817000, "checksum": "55ab0b3458381b69a6540dae272dbd3e54c956ad"}}' stage: Modified - name: Modified6843 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2676", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606817000, "checksum": "55ab0b3458381b69a6540dae272dbd3e54c956ad"}}' stage: Modified - name: Modified6844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2677", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606817000, "checksum": "55ab0b3458381b69a6540dae272dbd3e54c956ad"}}' stage: Modified - name: Modified6845 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2678", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606817000, "checksum": "55ab0b3458381b69a6540dae272dbd3e54c956ad"}}' stage: Modified - name: Modified6846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723058,"checksum":"2cec1a3416975b0d6564202b7da4cf51efd78363"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2679", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "mtime": 1606817000, "checksum": "55ab0b3458381b69a6540dae272dbd3e54c956ad"}}' stage: Modified - name: Modified6847 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2688","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219875,7 +219875,7 @@ stage: Modified - name: Modified6848 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2689","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219895,7 +219895,7 @@ stage: Modified - name: Modified6849 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2690","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219915,7 +219915,7 @@ stage: Modified - name: Modified6850 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2691","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219935,7 +219935,7 @@ stage: Modified - name: Modified6851 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2692","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219955,7 +219955,7 @@ stage: Modified - name: Modified6852 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2693","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219975,7 +219975,7 @@ stage: Modified - name: Modified6853 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2694","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -219995,7 +219995,7 @@ stage: Modified - name: Modified6854 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2695","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220015,7 +220015,7 @@ stage: Modified - name: Modified6855 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2704", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220023,7 +220023,7 @@ stage: Modified - name: Modified6856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2705", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220031,7 +220031,7 @@ stage: Modified - name: Modified6857 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2706", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220039,7 +220039,7 @@ stage: Modified - name: Modified6858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2707", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220047,7 +220047,7 @@ stage: Modified - name: Modified6859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2708", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220055,7 +220055,7 @@ stage: Modified - name: Modified6860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2709", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220063,7 +220063,7 @@ stage: Modified - name: Modified6861 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2710", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220071,7 +220071,7 @@ stage: Modified - name: Modified6862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"b34646c35e98b0d6b5c55cb951af15c861edbe47"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723058,"checksum":"829a90e7f9fe00a378773924c82455c29c373080"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2711", "arch": "[x64]", "timestamp": 1606863816, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220079,7 +220079,7 @@ stage: Modified - name: Modified6863 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2720","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220099,7 +220099,7 @@ stage: Modified - name: Modified6864 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2721","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220119,7 +220119,7 @@ stage: Modified - name: Modified6865 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2722","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220139,7 +220139,7 @@ stage: Modified - name: Modified6866 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2723","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220159,7 +220159,7 @@ stage: Modified - name: Modified6867 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2724","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220179,7 +220179,7 @@ stage: Modified - name: Modified6868 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2725","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220199,7 +220199,7 @@ stage: Modified - name: Modified6869 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2726","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220219,7 +220219,7 @@ stage: Modified - name: Modified6870 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2727","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863816,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220239,7 +220239,7 @@ stage: Modified - name: Modified6871 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2736", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817000, @@ -220247,7 +220247,7 @@ stage: Modified - name: Modified6872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2737", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817000, @@ -220255,7 +220255,7 @@ stage: Modified - name: Modified6873 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2738", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817000, @@ -220263,7 +220263,7 @@ stage: Modified - name: Modified6874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2739", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817000, @@ -220271,7 +220271,7 @@ stage: Modified - name: Modified6875 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2740", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817000, @@ -220279,7 +220279,7 @@ stage: Modified - name: Modified6876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2741", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817000, @@ -220287,7 +220287,7 @@ stage: Modified - name: Modified6877 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2742", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817000, @@ -220295,7 +220295,7 @@ stage: Modified - name: Modified6878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817000,"checksum":"2fafb9bfb48cb8419f2d19c4bd55fc30d2f3c0c3"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2743", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817000, @@ -220303,7 +220303,7 @@ stage: Modified - name: Modified6879 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2752","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220323,7 +220323,7 @@ stage: Modified - name: Modified6880 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2753","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220343,7 +220343,7 @@ stage: Modified - name: Modified6881 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2754","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220363,7 +220363,7 @@ stage: Modified - name: Modified6882 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2755","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220383,7 +220383,7 @@ stage: Modified - name: Modified6883 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2756","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220403,7 +220403,7 @@ stage: Modified - name: Modified6884 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2757","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220423,7 +220423,7 @@ stage: Modified - name: Modified6885 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2758","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220443,7 +220443,7 @@ stage: Modified - name: Modified6886 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2759","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220463,7 +220463,7 @@ stage: Modified - name: Modified6887 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2768", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -220471,7 +220471,7 @@ stage: Modified - name: Modified6888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2769", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -220479,7 +220479,7 @@ stage: Modified - name: Modified6889 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2770", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -220487,7 +220487,7 @@ stage: Modified - name: Modified6890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2771", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -220495,7 +220495,7 @@ stage: Modified - name: Modified6891 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2772", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -220503,7 +220503,7 @@ stage: Modified - name: Modified6892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2773", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -220511,7 +220511,7 @@ stage: Modified - name: Modified6893 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2774", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -220519,7 +220519,7 @@ stage: Modified - name: Modified6894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817000,"checksum":"ff29e24f2510b2dbead2e37df0845b8d171d0768"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2775", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -220527,7 +220527,7 @@ stage: Modified - name: Modified6895 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2784","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220546,7 +220546,7 @@ stage: Modified - name: Modified6896 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2785","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220565,7 +220565,7 @@ stage: Modified - name: Modified6897 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2786","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220584,7 +220584,7 @@ stage: Modified - name: Modified6898 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2787","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220603,7 +220603,7 @@ stage: Modified - name: Modified6899 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2788","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220622,7 +220622,7 @@ stage: Modified - name: Modified6900 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2789","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220641,7 +220641,7 @@ stage: Modified - name: Modified6901 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2790","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220660,7 +220660,7 @@ stage: Modified - name: Modified6902 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2791","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220679,63 +220679,63 @@ stage: Modified - name: Modified6903 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817000,"checksum":"55ab0b3458381b69a6540dae272dbd3e54c956ad"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2800", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817000, "checksum": "55ab0b3458381b69a6540dae272dbd3e54c956ad"}}' stage: Modified - name: Modified6904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2801", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817001, "checksum": "cae762859c10f6a445960550377a785fa87ec676"}}' stage: Modified - name: Modified6905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2802", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817001, "checksum": "cae762859c10f6a445960550377a785fa87ec676"}}' stage: Modified - name: Modified6906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2803", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817001, "checksum": "cae762859c10f6a445960550377a785fa87ec676"}}' stage: Modified - name: Modified6907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2804", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817001, "checksum": "cae762859c10f6a445960550377a785fa87ec676"}}' stage: Modified - name: Modified6908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2805", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817001, "checksum": "cae762859c10f6a445960550377a785fa87ec676"}}' stage: Modified - name: Modified6909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2806", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817001, "checksum": "cae762859c10f6a445960550377a785fa87ec676"}}' stage: Modified - name: Modified6910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817001,"checksum":"cae762859c10f6a445960550377a785fa87ec676"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723059,"checksum":"27025825f707642bef06b26085941cc9b734b44e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2807", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817001, "checksum": "cae762859c10f6a445960550377a785fa87ec676"}}' stage: Modified - name: Modified6911 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2816","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220755,7 +220755,7 @@ stage: Modified - name: Modified6912 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2817","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220775,7 +220775,7 @@ stage: Modified - name: Modified6913 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2818","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220795,7 +220795,7 @@ stage: Modified - name: Modified6914 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2819","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220815,7 +220815,7 @@ stage: Modified - name: Modified6915 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2820","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220835,7 +220835,7 @@ stage: Modified - name: Modified6916 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2821","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220855,7 +220855,7 @@ stage: Modified - name: Modified6917 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2822","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220875,7 +220875,7 @@ stage: Modified - name: Modified6918 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2823","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220895,7 +220895,7 @@ stage: Modified - name: Modified6919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2832", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220903,7 +220903,7 @@ stage: Modified - name: Modified6920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2833", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220911,7 +220911,7 @@ stage: Modified - name: Modified6921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2834", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220919,7 +220919,7 @@ stage: Modified - name: Modified6922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2835", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220927,7 +220927,7 @@ stage: Modified - name: Modified6923 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2836", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220935,7 +220935,7 @@ stage: Modified - name: Modified6924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2837", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220943,7 +220943,7 @@ stage: Modified - name: Modified6925 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2838", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220951,7 +220951,7 @@ stage: Modified - name: Modified6926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"f74188b62a8cd41f25279a31e8363ba3f5109511"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"e1620990b5622be397a877648f66ad5113b63e5a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2839", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -220959,7 +220959,7 @@ stage: Modified - name: Modified6927 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2848","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220979,7 +220979,7 @@ stage: Modified - name: Modified6928 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2849","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -220999,7 +220999,7 @@ stage: Modified - name: Modified6929 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2850","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221019,7 +221019,7 @@ stage: Modified - name: Modified6930 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2851","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221039,7 +221039,7 @@ stage: Modified - name: Modified6931 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2852","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221059,7 +221059,7 @@ stage: Modified - name: Modified6932 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2853","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221079,7 +221079,7 @@ stage: Modified - name: Modified6933 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2854","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221099,7 +221099,7 @@ stage: Modified - name: Modified6934 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2855","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221119,7 +221119,7 @@ stage: Modified - name: Modified6935 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2864", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817001, @@ -221127,7 +221127,7 @@ stage: Modified - name: Modified6936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2865", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817001, @@ -221135,7 +221135,7 @@ stage: Modified - name: Modified6937 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2866", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817001, @@ -221143,7 +221143,7 @@ stage: Modified - name: Modified6938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2867", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817001, @@ -221151,7 +221151,7 @@ stage: Modified - name: Modified6939 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2868", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817001, @@ -221159,7 +221159,7 @@ stage: Modified - name: Modified6940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2869", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817001, @@ -221167,7 +221167,7 @@ stage: Modified - name: Modified6941 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2870", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817001, @@ -221175,7 +221175,7 @@ stage: Modified - name: Modified6942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817001,"checksum":"323f6554ba8ee773e36ef9cc7e04f528c4cae46b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723059,"checksum":"7c1d292152bd81764df8398e061877324584559c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2871", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817001, @@ -221183,7 +221183,7 @@ stage: Modified - name: Modified6943 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2880","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221203,7 +221203,7 @@ stage: Modified - name: Modified6944 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2881","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221223,7 +221223,7 @@ stage: Modified - name: Modified6945 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2882","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221243,7 +221243,7 @@ stage: Modified - name: Modified6946 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2883","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221263,7 +221263,7 @@ stage: Modified - name: Modified6947 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2884","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221283,7 +221283,7 @@ stage: Modified - name: Modified6948 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2885","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221303,7 +221303,7 @@ stage: Modified - name: Modified6949 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2886","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221323,7 +221323,7 @@ stage: Modified - name: Modified6950 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2887","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221343,7 +221343,7 @@ stage: Modified - name: Modified6951 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2896", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -221351,7 +221351,7 @@ stage: Modified - name: Modified6952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723059,"checksum":"05bc7581a9fc1e1726565f2ce9265a14ba544e41"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2897", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -221359,7 +221359,7 @@ stage: Modified - name: Modified6953 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2898", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -221367,7 +221367,7 @@ stage: Modified - name: Modified6954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2899", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -221375,7 +221375,7 @@ stage: Modified - name: Modified6955 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2900", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -221383,7 +221383,7 @@ stage: Modified - name: Modified6956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2901", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -221391,7 +221391,7 @@ stage: Modified - name: Modified6957 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2902", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -221399,7 +221399,7 @@ stage: Modified - name: Modified6958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817001,"checksum":"68b6a8052e3e412fdb2bfa5657e8ab5caa946260"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"71a637ce7c2e829aae51325067b63bfa5dc6b3ab"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2903", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -221407,7 +221407,7 @@ stage: Modified - name: Modified6959 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2912","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221426,7 +221426,7 @@ stage: Modified - name: Modified6960 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2913","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221445,7 +221445,7 @@ stage: Modified - name: Modified6961 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2914","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221464,7 +221464,7 @@ stage: Modified - name: Modified6962 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2915","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221483,7 +221483,7 @@ stage: Modified - name: Modified6963 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2916","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221502,7 +221502,7 @@ stage: Modified - name: Modified6964 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2917","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221521,7 +221521,7 @@ stage: Modified - name: Modified6965 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2918","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221540,7 +221540,7 @@ stage: Modified - name: Modified6966 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2919","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221559,63 +221559,63 @@ stage: Modified - name: Modified6967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2928", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified6968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2929", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified6969 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2930", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified6970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2931", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified6971 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2932", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified6972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2933", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified6973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2934", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified6974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723060,"checksum":"e3dc3b80c2150280d6be68e876ad7c344265a484"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2935", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified6975 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2944","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221635,7 +221635,7 @@ stage: Modified - name: Modified6976 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2945","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221655,7 +221655,7 @@ stage: Modified - name: Modified6977 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2946","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221675,7 +221675,7 @@ stage: Modified - name: Modified6978 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2947","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221695,7 +221695,7 @@ stage: Modified - name: Modified6979 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2948","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221715,7 +221715,7 @@ stage: Modified - name: Modified6980 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2949","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221735,7 +221735,7 @@ stage: Modified - name: Modified6981 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2950","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221755,7 +221755,7 @@ stage: Modified - name: Modified6982 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2951","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221775,7 +221775,7 @@ stage: Modified - name: Modified6983 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2960", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -221783,7 +221783,7 @@ stage: Modified - name: Modified6984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2961", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -221791,7 +221791,7 @@ stage: Modified - name: Modified6985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2962", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -221799,7 +221799,7 @@ stage: Modified - name: Modified6986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2963", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -221807,7 +221807,7 @@ stage: Modified - name: Modified6987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2964", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -221815,7 +221815,7 @@ stage: Modified - name: Modified6988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2965", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -221823,7 +221823,7 @@ stage: Modified - name: Modified6989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2966", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -221831,7 +221831,7 @@ stage: Modified - name: Modified6990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"eb0a0d2dd690cb159d0da02f864569bc2bc70639"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723060,"checksum":"8d31ed7928d3c09df308361f53a8b93d8bdef6e8"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2967", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -221839,7 +221839,7 @@ stage: Modified - name: Modified6991 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2976","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221859,7 +221859,7 @@ stage: Modified - name: Modified6992 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2977","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221879,7 +221879,7 @@ stage: Modified - name: Modified6993 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2978","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221899,7 +221899,7 @@ stage: Modified - name: Modified6994 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2979","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221919,7 +221919,7 @@ stage: Modified - name: Modified6995 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2980","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221939,7 +221939,7 @@ stage: Modified - name: Modified6996 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2981","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221959,7 +221959,7 @@ stage: Modified - name: Modified6997 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2982","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221979,7 +221979,7 @@ stage: Modified - name: Modified6998 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2983","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -221999,7 +221999,7 @@ stage: Modified - name: Modified6999 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2992", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817002, @@ -222007,7 +222007,7 @@ stage: Modified - name: Modified7000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2993", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817002, @@ -222015,7 +222015,7 @@ stage: Modified - name: Modified7001 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2994", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817002, @@ -222023,7 +222023,7 @@ stage: Modified - name: Modified7002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2995", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817002, @@ -222031,7 +222031,7 @@ stage: Modified - name: Modified7003 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2996", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817002, @@ -222039,7 +222039,7 @@ stage: Modified - name: Modified7004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2997", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817002, @@ -222047,7 +222047,7 @@ stage: Modified - name: Modified7005 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2998", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817002, @@ -222055,7 +222055,7 @@ stage: Modified - name: Modified7006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817002,"checksum":"f6000d0e4b4ad43f9a56109a0ec6997ae8559b68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723060,"checksum":"6fc46f471c6f138270640e2ed7eda5657ca93d08"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2999", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817002, @@ -222063,7 +222063,7 @@ stage: Modified - name: Modified7007 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3008","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222083,7 +222083,7 @@ stage: Modified - name: Modified7008 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3009","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222103,7 +222103,7 @@ stage: Modified - name: Modified7009 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3010","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222123,7 +222123,7 @@ stage: Modified - name: Modified7010 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3011","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222143,7 +222143,7 @@ stage: Modified - name: Modified7011 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3012","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222163,7 +222163,7 @@ stage: Modified - name: Modified7012 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3013","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222183,7 +222183,7 @@ stage: Modified - name: Modified7013 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3014","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222203,7 +222203,7 @@ stage: Modified - name: Modified7014 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3015","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222223,7 +222223,7 @@ stage: Modified - name: Modified7015 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3024", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -222231,7 +222231,7 @@ stage: Modified - name: Modified7016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3025", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -222239,7 +222239,7 @@ stage: Modified - name: Modified7017 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3026", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -222247,7 +222247,7 @@ stage: Modified - name: Modified7018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3027", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -222255,7 +222255,7 @@ stage: Modified - name: Modified7019 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3028", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -222263,7 +222263,7 @@ stage: Modified - name: Modified7020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3029", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -222271,7 +222271,7 @@ stage: Modified - name: Modified7021 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3030", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -222279,7 +222279,7 @@ stage: Modified - name: Modified7022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817002,"checksum":"3f77fe9344d6509cdc7aed5a0a5263499ecfa575"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3031", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -222287,7 +222287,7 @@ stage: Modified - name: Modified7023 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3040","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222306,7 +222306,7 @@ stage: Modified - name: Modified7024 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3041","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222325,7 +222325,7 @@ stage: Modified - name: Modified7025 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3042","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222344,7 +222344,7 @@ stage: Modified - name: Modified7026 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3043","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222363,7 +222363,7 @@ stage: Modified - name: Modified7027 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3044","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222382,7 +222382,7 @@ stage: Modified - name: Modified7028 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3045","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222401,7 +222401,7 @@ stage: Modified - name: Modified7029 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3046","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222420,7 +222420,7 @@ stage: Modified - name: Modified7030 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3047","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222439,63 +222439,63 @@ stage: Modified - name: Modified7031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3056", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified7032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3057", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified7033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3058", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified7034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3059", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified7035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3060", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified7036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3061", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified7037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3062", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified7038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","mtime":1606817002,"checksum":"e9cf31fe8666309df4e21a8633fcb58421d5d913"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723061,"checksum":"eae010665beb6216af93aa97ad74c9ffb9fc267f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3063", "arch": "[x64]", "timestamp": 1606863817, "attributes": {"type": "registry_key", "mtime": 1606817002, "checksum": "e9cf31fe8666309df4e21a8633fcb58421d5d913"}}' stage: Modified - name: Modified7039 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3072","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222515,7 +222515,7 @@ stage: Modified - name: Modified7040 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3073","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222535,7 +222535,7 @@ stage: Modified - name: Modified7041 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3074","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222555,7 +222555,7 @@ stage: Modified - name: Modified7042 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3075","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222575,7 +222575,7 @@ stage: Modified - name: Modified7043 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3076","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222595,7 +222595,7 @@ stage: Modified - name: Modified7044 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3077","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222615,7 +222615,7 @@ stage: Modified - name: Modified7045 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3078","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222635,7 +222635,7 @@ stage: Modified - name: Modified7046 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3079","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863817,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222655,7 +222655,7 @@ stage: Modified - name: Modified7047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3088", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -222663,7 +222663,7 @@ stage: Modified - name: Modified7048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3089", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -222671,7 +222671,7 @@ stage: Modified - name: Modified7049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3090", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -222679,7 +222679,7 @@ stage: Modified - name: Modified7050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3091", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -222687,7 +222687,7 @@ stage: Modified - name: Modified7051 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3092", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -222695,7 +222695,7 @@ stage: Modified - name: Modified7052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3093", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -222703,7 +222703,7 @@ stage: Modified - name: Modified7053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3094", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -222711,7 +222711,7 @@ stage: Modified - name: Modified7054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"269ee251304073281784182ab045e788f1d1fcb4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"16abc3dffa6110910ec32ebaa0841137ee325201"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3095", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -222719,7 +222719,7 @@ stage: Modified - name: Modified7055 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3104","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222739,7 +222739,7 @@ stage: Modified - name: Modified7056 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3105","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222759,7 +222759,7 @@ stage: Modified - name: Modified7057 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3106","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222779,7 +222779,7 @@ stage: Modified - name: Modified7058 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3107","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222799,7 +222799,7 @@ stage: Modified - name: Modified7059 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3108","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222819,7 +222819,7 @@ stage: Modified - name: Modified7060 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3109","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222839,7 +222839,7 @@ stage: Modified - name: Modified7061 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3110","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222859,7 +222859,7 @@ stage: Modified - name: Modified7062 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3111","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222879,7 +222879,7 @@ stage: Modified - name: Modified7063 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3120", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817003, @@ -222887,7 +222887,7 @@ stage: Modified - name: Modified7064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3121", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817003, @@ -222895,7 +222895,7 @@ stage: Modified - name: Modified7065 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3122", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817003, @@ -222903,7 +222903,7 @@ stage: Modified - name: Modified7066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3123", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817003, @@ -222911,7 +222911,7 @@ stage: Modified - name: Modified7067 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3124", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817003, @@ -222919,7 +222919,7 @@ stage: Modified - name: Modified7068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3125", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817003, @@ -222927,7 +222927,7 @@ stage: Modified - name: Modified7069 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3126", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817003, @@ -222935,7 +222935,7 @@ stage: Modified - name: Modified7070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817003,"checksum":"257518f6341710b308790f63c7853a704b7fa905"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723061,"checksum":"596913c4addc71ec6283a233ac7f450506ee99cd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3127", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817003, @@ -222943,7 +222943,7 @@ stage: Modified - name: Modified7071 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3136","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222963,7 +222963,7 @@ stage: Modified - name: Modified7072 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3137","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -222983,7 +222983,7 @@ stage: Modified - name: Modified7073 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3138","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223003,7 +223003,7 @@ stage: Modified - name: Modified7074 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3139","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223023,7 +223023,7 @@ stage: Modified - name: Modified7075 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3140","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223043,7 +223043,7 @@ stage: Modified - name: Modified7076 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3141","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223063,7 +223063,7 @@ stage: Modified - name: Modified7077 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3142","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223083,7 +223083,7 @@ stage: Modified - name: Modified7078 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3143","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223103,7 +223103,7 @@ stage: Modified - name: Modified7079 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3152", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -223111,7 +223111,7 @@ stage: Modified - name: Modified7080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3153", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -223119,7 +223119,7 @@ stage: Modified - name: Modified7081 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3154", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -223127,7 +223127,7 @@ stage: Modified - name: Modified7082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3155", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -223135,7 +223135,7 @@ stage: Modified - name: Modified7083 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3156", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -223143,7 +223143,7 @@ stage: Modified - name: Modified7084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3157", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -223151,7 +223151,7 @@ stage: Modified - name: Modified7085 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3158", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -223159,7 +223159,7 @@ stage: Modified - name: Modified7086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817003,"checksum":"7e9a2e7a368c5da7fbcf9ae3d538fee4683a4e13"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723061,"checksum":"b6b601088e7810e20ce3d486b00372e730b05859"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3159", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -223167,7 +223167,7 @@ stage: Modified - name: Modified7087 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3168","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223186,7 +223186,7 @@ stage: Modified - name: Modified7088 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3169","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223205,7 +223205,7 @@ stage: Modified - name: Modified7089 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3170","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223224,7 +223224,7 @@ stage: Modified - name: Modified7090 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3171","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223243,7 +223243,7 @@ stage: Modified - name: Modified7091 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3172","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223262,7 +223262,7 @@ stage: Modified - name: Modified7092 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3173","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223281,7 +223281,7 @@ stage: Modified - name: Modified7093 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3174","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223300,7 +223300,7 @@ stage: Modified - name: Modified7094 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3175","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223319,63 +223319,63 @@ stage: Modified - name: Modified7095 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3184", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817003, "checksum": "feb960b22fefbc5e61fe62f743fe23ed725f85c4"}}' stage: Modified - name: Modified7096 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3185", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817003, "checksum": "feb960b22fefbc5e61fe62f743fe23ed725f85c4"}}' stage: Modified - name: Modified7097 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3186", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817003, "checksum": "feb960b22fefbc5e61fe62f743fe23ed725f85c4"}}' stage: Modified - name: Modified7098 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3187", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817003, "checksum": "feb960b22fefbc5e61fe62f743fe23ed725f85c4"}}' stage: Modified - name: Modified7099 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3188", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817003, "checksum": "feb960b22fefbc5e61fe62f743fe23ed725f85c4"}}' stage: Modified - name: Modified7100 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3189", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817003, "checksum": "feb960b22fefbc5e61fe62f743fe23ed725f85c4"}}' stage: Modified - name: Modified7101 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3190", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817003, "checksum": "feb960b22fefbc5e61fe62f743fe23ed725f85c4"}}' stage: Modified - name: Modified7102 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817003,"checksum":"feb960b22fefbc5e61fe62f743fe23ed725f85c4"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3191", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817003, "checksum": "feb960b22fefbc5e61fe62f743fe23ed725f85c4"}}' stage: Modified - name: Modified7103 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3200","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223395,7 +223395,7 @@ stage: Modified - name: Modified7104 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3201","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223415,7 +223415,7 @@ stage: Modified - name: Modified7105 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3202","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223435,7 +223435,7 @@ stage: Modified - name: Modified7106 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3203","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223455,7 +223455,7 @@ stage: Modified - name: Modified7107 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3204","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223475,7 +223475,7 @@ stage: Modified - name: Modified7108 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3205","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223495,7 +223495,7 @@ stage: Modified - name: Modified7109 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3206","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223515,7 +223515,7 @@ stage: Modified - name: Modified7110 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3207","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223535,7 +223535,7 @@ stage: Modified - name: Modified7111 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3216", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -223543,7 +223543,7 @@ stage: Modified - name: Modified7112 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3217", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -223551,7 +223551,7 @@ stage: Modified - name: Modified7113 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3218", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -223559,7 +223559,7 @@ stage: Modified - name: Modified7114 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3219", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -223567,7 +223567,7 @@ stage: Modified - name: Modified7115 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3220", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -223575,7 +223575,7 @@ stage: Modified - name: Modified7116 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3221", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -223583,7 +223583,7 @@ stage: Modified - name: Modified7117 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3222", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -223591,7 +223591,7 @@ stage: Modified - name: Modified7118 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"4fa99895681e2ecf61aad34d157ca79b60fcefce"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3223", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -223599,7 +223599,7 @@ stage: Modified - name: Modified7119 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3232","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223619,7 +223619,7 @@ stage: Modified - name: Modified7120 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3233","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223639,7 +223639,7 @@ stage: Modified - name: Modified7121 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3234","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223659,7 +223659,7 @@ stage: Modified - name: Modified7122 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3235","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223679,7 +223679,7 @@ stage: Modified - name: Modified7123 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3236","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223699,7 +223699,7 @@ stage: Modified - name: Modified7124 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3237","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223719,7 +223719,7 @@ stage: Modified - name: Modified7125 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3238","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223739,7 +223739,7 @@ stage: Modified - name: Modified7126 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3239","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223759,7 +223759,7 @@ stage: Modified - name: Modified7127 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3248", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817004, @@ -223767,7 +223767,7 @@ stage: Modified - name: Modified7128 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3249", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817004, @@ -223775,7 +223775,7 @@ stage: Modified - name: Modified7129 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3250", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817004, @@ -223783,7 +223783,7 @@ stage: Modified - name: Modified7130 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3251", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817004, @@ -223791,7 +223791,7 @@ stage: Modified - name: Modified7131 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3252", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817004, @@ -223799,7 +223799,7 @@ stage: Modified - name: Modified7132 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3253", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817004, @@ -223807,7 +223807,7 @@ stage: Modified - name: Modified7133 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3254", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817004, @@ -223815,7 +223815,7 @@ stage: Modified - name: Modified7134 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817004,"checksum":"d3a2bd79ca8752190eb69793cc7ab3b2ddb12945"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723062,"checksum":"a50807fa3c86950bc3af22a0a183280178ab543c"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3255", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817004, @@ -223823,7 +223823,7 @@ stage: Modified - name: Modified7135 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3264","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223843,7 +223843,7 @@ stage: Modified - name: Modified7136 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3265","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223863,7 +223863,7 @@ stage: Modified - name: Modified7137 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3266","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223883,7 +223883,7 @@ stage: Modified - name: Modified7138 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3267","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223903,7 +223903,7 @@ stage: Modified - name: Modified7139 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3268","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223923,7 +223923,7 @@ stage: Modified - name: Modified7140 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3269","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223943,7 +223943,7 @@ stage: Modified - name: Modified7141 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3270","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223963,7 +223963,7 @@ stage: Modified - name: Modified7142 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3271","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -223983,7 +223983,7 @@ stage: Modified - name: Modified7143 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3280", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -223991,7 +223991,7 @@ stage: Modified - name: Modified7144 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3281", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -223999,7 +223999,7 @@ stage: Modified - name: Modified7145 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3282", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224007,7 +224007,7 @@ stage: Modified - name: Modified7146 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3283", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224015,7 +224015,7 @@ stage: Modified - name: Modified7147 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3284", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224023,7 +224023,7 @@ stage: Modified - name: Modified7148 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3285", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224031,7 +224031,7 @@ stage: Modified - name: Modified7149 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3286", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224039,7 +224039,7 @@ stage: Modified - name: Modified7150 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817004,"checksum":"f013eaac605f0ba3641cff960261d8e0ffd64936"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"0e1273b37e2faffcc872bd15a9e14d4d22ad2062"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3287", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224047,7 +224047,7 @@ stage: Modified - name: Modified7151 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3296","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224066,7 +224066,7 @@ stage: Modified - name: Modified7152 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3297","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224085,7 +224085,7 @@ stage: Modified - name: Modified7153 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3298","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224104,7 +224104,7 @@ stage: Modified - name: Modified7154 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3299","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224123,7 +224123,7 @@ stage: Modified - name: Modified7155 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3300","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224142,7 +224142,7 @@ stage: Modified - name: Modified7156 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3301","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224161,7 +224161,7 @@ stage: Modified - name: Modified7157 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3302","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224180,7 +224180,7 @@ stage: Modified - name: Modified7158 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3303","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224199,63 +224199,63 @@ stage: Modified - name: Modified7159 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3312", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817004, "checksum": "46a1d781eb1b80d1843be62dbfad1e28fd5372e5"}}' stage: Modified - name: Modified7160 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3313", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817004, "checksum": "46a1d781eb1b80d1843be62dbfad1e28fd5372e5"}}' stage: Modified - name: Modified7161 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3314", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817004, "checksum": "46a1d781eb1b80d1843be62dbfad1e28fd5372e5"}}' stage: Modified - name: Modified7162 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3315", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817004, "checksum": "46a1d781eb1b80d1843be62dbfad1e28fd5372e5"}}' stage: Modified - name: Modified7163 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3316", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817004, "checksum": "46a1d781eb1b80d1843be62dbfad1e28fd5372e5"}}' stage: Modified - name: Modified7164 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3317", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817004, "checksum": "46a1d781eb1b80d1843be62dbfad1e28fd5372e5"}}' stage: Modified - name: Modified7165 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3318", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817004, "checksum": "46a1d781eb1b80d1843be62dbfad1e28fd5372e5"}}' stage: Modified - name: Modified7166 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817004,"checksum":"46a1d781eb1b80d1843be62dbfad1e28fd5372e5"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723062,"checksum":"f18a93ebcc8ec9f28258003bb1fd0d0adca1e430"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3319", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817004, "checksum": "46a1d781eb1b80d1843be62dbfad1e28fd5372e5"}}' stage: Modified - name: Modified7167 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3328","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224275,7 +224275,7 @@ stage: Modified - name: Modified7168 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3329","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224295,7 +224295,7 @@ stage: Modified - name: Modified7169 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3330","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224315,7 +224315,7 @@ stage: Modified - name: Modified7170 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3331","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224335,7 +224335,7 @@ stage: Modified - name: Modified7171 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3332","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224355,7 +224355,7 @@ stage: Modified - name: Modified7172 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3333","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224375,7 +224375,7 @@ stage: Modified - name: Modified7173 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3334","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224395,7 +224395,7 @@ stage: Modified - name: Modified7174 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3335","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224415,7 +224415,7 @@ stage: Modified - name: Modified7175 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3344", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -224423,7 +224423,7 @@ stage: Modified - name: Modified7176 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3345", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -224431,7 +224431,7 @@ stage: Modified - name: Modified7177 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3346", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -224439,7 +224439,7 @@ stage: Modified - name: Modified7178 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3347", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -224447,7 +224447,7 @@ stage: Modified - name: Modified7179 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3348", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -224455,7 +224455,7 @@ stage: Modified - name: Modified7180 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3349", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -224463,7 +224463,7 @@ stage: Modified - name: Modified7181 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3350", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -224471,7 +224471,7 @@ stage: Modified - name: Modified7182 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"b349cb1bfbcc259a31313360e6d2a35958cdfe68"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723062,"checksum":"80c94fa58003db14cb0301fa944d9a14b32dc368"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3351", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -224479,7 +224479,7 @@ stage: Modified - name: Modified7183 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3360","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224499,7 +224499,7 @@ stage: Modified - name: Modified7184 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3361","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224519,7 +224519,7 @@ stage: Modified - name: Modified7185 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3362","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224539,7 +224539,7 @@ stage: Modified - name: Modified7186 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3363","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224559,7 +224559,7 @@ stage: Modified - name: Modified7187 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3364","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224579,7 +224579,7 @@ stage: Modified - name: Modified7188 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3365","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224599,7 +224599,7 @@ stage: Modified - name: Modified7189 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3366","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224619,7 +224619,7 @@ stage: Modified - name: Modified7190 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3367","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224639,7 +224639,7 @@ stage: Modified - name: Modified7191 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3376", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817005, @@ -224647,7 +224647,7 @@ stage: Modified - name: Modified7192 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3377", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817005, @@ -224655,7 +224655,7 @@ stage: Modified - name: Modified7193 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3378", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817005, @@ -224663,7 +224663,7 @@ stage: Modified - name: Modified7194 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3379", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817005, @@ -224671,7 +224671,7 @@ stage: Modified - name: Modified7195 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3380", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817005, @@ -224679,7 +224679,7 @@ stage: Modified - name: Modified7196 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3381", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817005, @@ -224687,7 +224687,7 @@ stage: Modified - name: Modified7197 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3382", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817005, @@ -224695,7 +224695,7 @@ stage: Modified - name: Modified7198 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817005,"checksum":"ad56250b1f0e9dee3d3d67538aef0940fa064cdc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3383", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817005, @@ -224703,7 +224703,7 @@ stage: Modified - name: Modified7199 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3392","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224723,7 +224723,7 @@ stage: Modified - name: Modified7200 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3393","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224743,7 +224743,7 @@ stage: Modified - name: Modified7201 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3394","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224763,7 +224763,7 @@ stage: Modified - name: Modified7202 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3395","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224783,7 +224783,7 @@ stage: Modified - name: Modified7203 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3396","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224803,7 +224803,7 @@ stage: Modified - name: Modified7204 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3397","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224823,7 +224823,7 @@ stage: Modified - name: Modified7205 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3398","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224843,7 +224843,7 @@ stage: Modified - name: Modified7206 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3399","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224863,7 +224863,7 @@ stage: Modified - name: Modified7207 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3408", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224871,7 +224871,7 @@ stage: Modified - name: Modified7208 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3409", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224879,7 +224879,7 @@ stage: Modified - name: Modified7209 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3410", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224887,7 +224887,7 @@ stage: Modified - name: Modified7210 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3411", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224895,7 +224895,7 @@ stage: Modified - name: Modified7211 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3412", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224903,7 +224903,7 @@ stage: Modified - name: Modified7212 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3413", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224911,7 +224911,7 @@ stage: Modified - name: Modified7213 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3414", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224919,7 +224919,7 @@ stage: Modified - name: Modified7214 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817005,"checksum":"7aae7eb39f2d21bdabe4e05479dbc2a4debef99f"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"f9de8e5a7bb4b0d2badb5a7c2c50385a233af6bb"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3415", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -224927,7 +224927,7 @@ stage: Modified - name: Modified7215 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3424","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224946,7 +224946,7 @@ stage: Modified - name: Modified7216 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3425","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224965,7 +224965,7 @@ stage: Modified - name: Modified7217 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3426","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -224984,7 +224984,7 @@ stage: Modified - name: Modified7218 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3427","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225003,7 +225003,7 @@ stage: Modified - name: Modified7219 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3428","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225022,7 +225022,7 @@ stage: Modified - name: Modified7220 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3429","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225041,7 +225041,7 @@ stage: Modified - name: Modified7221 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3430","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225060,7 +225060,7 @@ stage: Modified - name: Modified7222 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3431","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225079,63 +225079,63 @@ stage: Modified - name: Modified7223 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3440", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817005, "checksum": "6aae1d80a6be6602708aa5b7c1e20b578e0b0989"}}' stage: Modified - name: Modified7224 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3441", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817005, "checksum": "6aae1d80a6be6602708aa5b7c1e20b578e0b0989"}}' stage: Modified - name: Modified7225 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3442", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817005, "checksum": "6aae1d80a6be6602708aa5b7c1e20b578e0b0989"}}' stage: Modified - name: Modified7226 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3443", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817005, "checksum": "6aae1d80a6be6602708aa5b7c1e20b578e0b0989"}}' stage: Modified - name: Modified7227 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3444", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817005, "checksum": "6aae1d80a6be6602708aa5b7c1e20b578e0b0989"}}' stage: Modified - name: Modified7228 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3445", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817005, "checksum": "6aae1d80a6be6602708aa5b7c1e20b578e0b0989"}}' stage: Modified - name: Modified7229 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3446", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817005, "checksum": "6aae1d80a6be6602708aa5b7c1e20b578e0b0989"}}' stage: Modified - name: Modified7230 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","mtime":1606817005,"checksum":"6aae1d80a6be6602708aa5b7c1e20b578e0b0989"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723063,"checksum":"58709fd6efda779a10de280edc4ffe110c3fc72e"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3447", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "mtime": 1606817005, "checksum": "6aae1d80a6be6602708aa5b7c1e20b578e0b0989"}}' stage: Modified - name: Modified7231 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3456","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225155,7 +225155,7 @@ stage: Modified - name: Modified7232 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3457","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225175,7 +225175,7 @@ stage: Modified - name: Modified7233 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3458","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225195,7 +225195,7 @@ stage: Modified - name: Modified7234 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3459","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225215,7 +225215,7 @@ stage: Modified - name: Modified7235 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3460","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225235,7 +225235,7 @@ stage: Modified - name: Modified7236 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3461","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225255,7 +225255,7 @@ stage: Modified - name: Modified7237 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3462","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225275,7 +225275,7 @@ stage: Modified - name: Modified7238 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3463","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225295,7 +225295,7 @@ stage: Modified - name: Modified7239 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3472", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -225303,7 +225303,7 @@ stage: Modified - name: Modified7240 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3473", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -225311,7 +225311,7 @@ stage: Modified - name: Modified7241 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3474", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -225319,7 +225319,7 @@ stage: Modified - name: Modified7242 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3475", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -225327,7 +225327,7 @@ stage: Modified - name: Modified7243 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3476", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -225335,7 +225335,7 @@ stage: Modified - name: Modified7244 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3477", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -225343,7 +225343,7 @@ stage: Modified - name: Modified7245 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3478", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -225351,7 +225351,7 @@ stage: Modified - name: Modified7246 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723063,"checksum":"14a299fd51a61a84993318ebe810ada0afaf6386"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3479", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -225359,7 +225359,7 @@ stage: Modified - name: Modified7247 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3488","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225379,7 +225379,7 @@ stage: Modified - name: Modified7248 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3489","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225399,7 +225399,7 @@ stage: Modified - name: Modified7249 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3490","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225419,7 +225419,7 @@ stage: Modified - name: Modified7250 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3491","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225439,7 +225439,7 @@ stage: Modified - name: Modified7251 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3492","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225459,7 +225459,7 @@ stage: Modified - name: Modified7252 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3493","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225479,7 +225479,7 @@ stage: Modified - name: Modified7253 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3494","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225499,7 +225499,7 @@ stage: Modified - name: Modified7254 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3495","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225519,7 +225519,7 @@ stage: Modified - name: Modified7255 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3504", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817006, @@ -225527,7 +225527,7 @@ stage: Modified - name: Modified7256 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3505", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817006, @@ -225535,7 +225535,7 @@ stage: Modified - name: Modified7257 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3506", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817006, @@ -225543,7 +225543,7 @@ stage: Modified - name: Modified7258 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3507", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817006, @@ -225551,7 +225551,7 @@ stage: Modified - name: Modified7259 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3508", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817006, @@ -225559,7 +225559,7 @@ stage: Modified - name: Modified7260 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3509", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817006, @@ -225567,7 +225567,7 @@ stage: Modified - name: Modified7261 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3510", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817006, @@ -225575,7 +225575,7 @@ stage: Modified - name: Modified7262 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817006,"checksum":"136253ac0b403a691fc7cf8ec3efd250f2e20a19"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723063,"checksum":"7f9716aa634347b89c1296f902b7b214769a750b"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3511", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817006, @@ -225583,7 +225583,7 @@ stage: Modified - name: Modified7263 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3520","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225603,7 +225603,7 @@ stage: Modified - name: Modified7264 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3521","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225623,7 +225623,7 @@ stage: Modified - name: Modified7265 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3522","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225643,7 +225643,7 @@ stage: Modified - name: Modified7266 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3523","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225663,7 +225663,7 @@ stage: Modified - name: Modified7267 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3524","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225683,7 +225683,7 @@ stage: Modified - name: Modified7268 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3525","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225703,7 +225703,7 @@ stage: Modified - name: Modified7269 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3526","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225723,7 +225723,7 @@ stage: Modified - name: Modified7270 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3527","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225743,7 +225743,7 @@ stage: Modified - name: Modified7271 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3536", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -225751,7 +225751,7 @@ stage: Modified - name: Modified7272 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3537", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -225759,7 +225759,7 @@ stage: Modified - name: Modified7273 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3538", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -225767,7 +225767,7 @@ stage: Modified - name: Modified7274 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3539", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -225775,7 +225775,7 @@ stage: Modified - name: Modified7275 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3540", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -225783,7 +225783,7 @@ stage: Modified - name: Modified7276 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3541", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -225791,7 +225791,7 @@ stage: Modified - name: Modified7277 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863818,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3542", "arch": "[x64]", "timestamp": 1606863818, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -225799,7 +225799,7 @@ stage: Modified - name: Modified7278 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"200914c9fd919d3c93c02076f799a0394f3f0ef9"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3543", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -225807,7 +225807,7 @@ stage: Modified - name: Modified7279 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3552","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225826,7 +225826,7 @@ stage: Modified - name: Modified7280 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3553","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225845,7 +225845,7 @@ stage: Modified - name: Modified7281 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3554","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225864,7 +225864,7 @@ stage: Modified - name: Modified7282 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3555","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225883,7 +225883,7 @@ stage: Modified - name: Modified7283 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3556","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225902,7 +225902,7 @@ stage: Modified - name: Modified7284 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3557","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225921,7 +225921,7 @@ stage: Modified - name: Modified7285 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3558","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225940,7 +225940,7 @@ stage: Modified - name: Modified7286 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3559","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -225959,63 +225959,63 @@ stage: Modified - name: Modified7287 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3568", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817006, "checksum": "50a3375687837865cac73ddd677b71b2b6f1ee50"}}' stage: Modified - name: Modified7288 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3569", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817006, "checksum": "50a3375687837865cac73ddd677b71b2b6f1ee50"}}' stage: Modified - name: Modified7289 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3570", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817006, "checksum": "50a3375687837865cac73ddd677b71b2b6f1ee50"}}' stage: Modified - name: Modified7290 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3571", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817006, "checksum": "50a3375687837865cac73ddd677b71b2b6f1ee50"}}' stage: Modified - name: Modified7291 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3572", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817006, "checksum": "50a3375687837865cac73ddd677b71b2b6f1ee50"}}' stage: Modified - name: Modified7292 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3573", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817006, "checksum": "50a3375687837865cac73ddd677b71b2b6f1ee50"}}' stage: Modified - name: Modified7293 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3574", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817006, "checksum": "50a3375687837865cac73ddd677b71b2b6f1ee50"}}' stage: Modified - name: Modified7294 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817006,"checksum":"50a3375687837865cac73ddd677b71b2b6f1ee50"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3575", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817006, "checksum": "50a3375687837865cac73ddd677b71b2b6f1ee50"}}' stage: Modified - name: Modified7295 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3584","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226035,7 +226035,7 @@ stage: Modified - name: Modified7296 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3585","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226055,7 +226055,7 @@ stage: Modified - name: Modified7297 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3586","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226075,7 +226075,7 @@ stage: Modified - name: Modified7298 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3587","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226095,7 +226095,7 @@ stage: Modified - name: Modified7299 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3588","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226115,7 +226115,7 @@ stage: Modified - name: Modified7300 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3589","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226135,7 +226135,7 @@ stage: Modified - name: Modified7301 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3590","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226155,7 +226155,7 @@ stage: Modified - name: Modified7302 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3591","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226175,7 +226175,7 @@ stage: Modified - name: Modified7303 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3600", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -226183,7 +226183,7 @@ stage: Modified - name: Modified7304 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3601", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -226191,7 +226191,7 @@ stage: Modified - name: Modified7305 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3602", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -226199,7 +226199,7 @@ stage: Modified - name: Modified7306 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3603", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -226207,7 +226207,7 @@ stage: Modified - name: Modified7307 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3604", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -226215,7 +226215,7 @@ stage: Modified - name: Modified7308 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3605", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -226223,7 +226223,7 @@ stage: Modified - name: Modified7309 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3606", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -226231,7 +226231,7 @@ stage: Modified - name: Modified7310 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817006,"checksum":"f658931b628a966cb567264b2860e767c496cb80"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"6f4a78d698b96d2d4284516e8c6ca9d13762d8a6"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3607", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -226239,7 +226239,7 @@ stage: Modified - name: Modified7311 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3616","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226259,7 +226259,7 @@ stage: Modified - name: Modified7312 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3617","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226279,7 +226279,7 @@ stage: Modified - name: Modified7313 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3618","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226299,7 +226299,7 @@ stage: Modified - name: Modified7314 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3619","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226319,7 +226319,7 @@ stage: Modified - name: Modified7315 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3620","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226339,7 +226339,7 @@ stage: Modified - name: Modified7316 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3621","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226359,7 +226359,7 @@ stage: Modified - name: Modified7317 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3622","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226379,7 +226379,7 @@ stage: Modified - name: Modified7318 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3623","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226399,7 +226399,7 @@ stage: Modified - name: Modified7319 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3632", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817007, @@ -226407,7 +226407,7 @@ stage: Modified - name: Modified7320 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3633", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817007, @@ -226415,7 +226415,7 @@ stage: Modified - name: Modified7321 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3634", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817007, @@ -226423,7 +226423,7 @@ stage: Modified - name: Modified7322 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3635", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817007, @@ -226431,7 +226431,7 @@ stage: Modified - name: Modified7323 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3636", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817007, @@ -226439,7 +226439,7 @@ stage: Modified - name: Modified7324 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3637", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817007, @@ -226447,7 +226447,7 @@ stage: Modified - name: Modified7325 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3638", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817007, @@ -226455,7 +226455,7 @@ stage: Modified - name: Modified7326 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817007,"checksum":"e53b2eb43e0d9fa1dc06ebef9a279667c20ed779"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723064,"checksum":"db03241f8e5cad7eca5aa6abb4d684a405fa282f"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3639", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817007, @@ -226463,7 +226463,7 @@ stage: Modified - name: Modified7327 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3648","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226483,7 +226483,7 @@ stage: Modified - name: Modified7328 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3649","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226503,7 +226503,7 @@ stage: Modified - name: Modified7329 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3650","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226523,7 +226523,7 @@ stage: Modified - name: Modified7330 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3651","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226543,7 +226543,7 @@ stage: Modified - name: Modified7331 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3652","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226563,7 +226563,7 @@ stage: Modified - name: Modified7332 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3653","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226583,7 +226583,7 @@ stage: Modified - name: Modified7333 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3654","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226603,7 +226603,7 @@ stage: Modified - name: Modified7334 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3655","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226623,7 +226623,7 @@ stage: Modified - name: Modified7335 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3664", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -226631,7 +226631,7 @@ stage: Modified - name: Modified7336 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3665", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -226639,7 +226639,7 @@ stage: Modified - name: Modified7337 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3666", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -226647,7 +226647,7 @@ stage: Modified - name: Modified7338 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3667", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -226655,7 +226655,7 @@ stage: Modified - name: Modified7339 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3668", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -226663,7 +226663,7 @@ stage: Modified - name: Modified7340 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3669", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -226671,7 +226671,7 @@ stage: Modified - name: Modified7341 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3670", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -226679,7 +226679,7 @@ stage: Modified - name: Modified7342 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"6b6ff8f6c24b0013427de54dd97f5e20eeb60823"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723064,"checksum":"f675fefdd2eb9e111331db0202022c12d040ef7d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3671", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -226687,7 +226687,7 @@ stage: Modified - name: Modified7343 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3680","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226706,7 +226706,7 @@ stage: Modified - name: Modified7344 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3681","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226725,7 +226725,7 @@ stage: Modified - name: Modified7345 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3682","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226744,7 +226744,7 @@ stage: Modified - name: Modified7346 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3683","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226763,7 +226763,7 @@ stage: Modified - name: Modified7347 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3684","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226782,7 +226782,7 @@ stage: Modified - name: Modified7348 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3685","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226801,7 +226801,7 @@ stage: Modified - name: Modified7349 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3686","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226820,7 +226820,7 @@ stage: Modified - name: Modified7350 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3687","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226839,63 +226839,63 @@ stage: Modified - name: Modified7351 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3696", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817007, "checksum": "f6078a0ccf2002ce2b19924dfe8aa7432c02012b"}}' stage: Modified - name: Modified7352 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3697", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817007, "checksum": "f6078a0ccf2002ce2b19924dfe8aa7432c02012b"}}' stage: Modified - name: Modified7353 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3698", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817007, "checksum": "f6078a0ccf2002ce2b19924dfe8aa7432c02012b"}}' stage: Modified - name: Modified7354 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3699", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817007, "checksum": "f6078a0ccf2002ce2b19924dfe8aa7432c02012b"}}' stage: Modified - name: Modified7355 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3700", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817007, "checksum": "f6078a0ccf2002ce2b19924dfe8aa7432c02012b"}}' stage: Modified - name: Modified7356 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3701", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817007, "checksum": "f6078a0ccf2002ce2b19924dfe8aa7432c02012b"}}' stage: Modified - name: Modified7357 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3702", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817007, "checksum": "f6078a0ccf2002ce2b19924dfe8aa7432c02012b"}}' stage: Modified - name: Modified7358 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817007,"checksum":"f6078a0ccf2002ce2b19924dfe8aa7432c02012b"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723064,"checksum":"85be963183184cb2765bece7c6ed4586ad84e849"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3703", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817007, "checksum": "f6078a0ccf2002ce2b19924dfe8aa7432c02012b"}}' stage: Modified - name: Modified7359 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3712","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226915,7 +226915,7 @@ stage: Modified - name: Modified7360 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3713","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226935,7 +226935,7 @@ stage: Modified - name: Modified7361 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3714","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226955,7 +226955,7 @@ stage: Modified - name: Modified7362 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3715","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226975,7 +226975,7 @@ stage: Modified - name: Modified7363 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3716","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -226995,7 +226995,7 @@ stage: Modified - name: Modified7364 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3717","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227015,7 +227015,7 @@ stage: Modified - name: Modified7365 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3718","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227035,7 +227035,7 @@ stage: Modified - name: Modified7366 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3719","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227055,7 +227055,7 @@ stage: Modified - name: Modified7367 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3728", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227063,7 +227063,7 @@ stage: Modified - name: Modified7368 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3729", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227071,7 +227071,7 @@ stage: Modified - name: Modified7369 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3730", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227079,7 +227079,7 @@ stage: Modified - name: Modified7370 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3731", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227087,7 +227087,7 @@ stage: Modified - name: Modified7371 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3732", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227095,7 +227095,7 @@ stage: Modified - name: Modified7372 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3733", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227103,7 +227103,7 @@ stage: Modified - name: Modified7373 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3734", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227111,7 +227111,7 @@ stage: Modified - name: Modified7374 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817007,"checksum":"98d0aff1346f85ce58ec769efe1974f70968f1c6"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3735", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227119,7 +227119,7 @@ stage: Modified - name: Modified7375 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3744","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227139,7 +227139,7 @@ stage: Modified - name: Modified7376 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3745","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227159,7 +227159,7 @@ stage: Modified - name: Modified7377 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3746","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227179,7 +227179,7 @@ stage: Modified - name: Modified7378 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3747","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227199,7 +227199,7 @@ stage: Modified - name: Modified7379 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3748","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227219,7 +227219,7 @@ stage: Modified - name: Modified7380 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3749","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227239,7 +227239,7 @@ stage: Modified - name: Modified7381 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3750","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227259,7 +227259,7 @@ stage: Modified - name: Modified7382 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3751","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227279,7 +227279,7 @@ stage: Modified - name: Modified7383 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3760", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817008, @@ -227287,7 +227287,7 @@ stage: Modified - name: Modified7384 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3761", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817008, @@ -227295,7 +227295,7 @@ stage: Modified - name: Modified7385 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3762", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817008, @@ -227303,7 +227303,7 @@ stage: Modified - name: Modified7386 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3763", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817008, @@ -227311,7 +227311,7 @@ stage: Modified - name: Modified7387 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3764", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817008, @@ -227319,7 +227319,7 @@ stage: Modified - name: Modified7388 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3765", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817008, @@ -227327,7 +227327,7 @@ stage: Modified - name: Modified7389 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3766", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817008, @@ -227335,7 +227335,7 @@ stage: Modified - name: Modified7390 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817008,"checksum":"338e12581284ca4209061856b5e9c88496dd876d"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723065,"checksum":"78494707e55cf98844fdba7b4b6f60e7f0e87234"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3767", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817008, @@ -227343,7 +227343,7 @@ stage: Modified - name: Modified7391 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3776","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227363,7 +227363,7 @@ stage: Modified - name: Modified7392 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3777","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227383,7 +227383,7 @@ stage: Modified - name: Modified7393 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3778","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227403,7 +227403,7 @@ stage: Modified - name: Modified7394 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3779","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227423,7 +227423,7 @@ stage: Modified - name: Modified7395 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3780","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227443,7 +227443,7 @@ stage: Modified - name: Modified7396 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3781","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227463,7 +227463,7 @@ stage: Modified - name: Modified7397 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3782","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227483,7 +227483,7 @@ stage: Modified - name: Modified7398 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3783","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227503,7 +227503,7 @@ stage: Modified - name: Modified7399 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3792", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -227511,7 +227511,7 @@ stage: Modified - name: Modified7400 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3793", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -227519,7 +227519,7 @@ stage: Modified - name: Modified7401 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3794", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -227527,7 +227527,7 @@ stage: Modified - name: Modified7402 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3795", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -227535,7 +227535,7 @@ stage: Modified - name: Modified7403 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3796", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -227543,7 +227543,7 @@ stage: Modified - name: Modified7404 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3797", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -227551,7 +227551,7 @@ stage: Modified - name: Modified7405 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3798", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -227559,7 +227559,7 @@ stage: Modified - name: Modified7406 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"c08b207a2845ef255dea15b05f7bc849f018d5b7"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"eea7b46d291282b27199eb815e2c56f65845093a"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3799", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -227567,7 +227567,7 @@ stage: Modified - name: Modified7407 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3808","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227586,7 +227586,7 @@ stage: Modified - name: Modified7408 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3809","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227605,7 +227605,7 @@ stage: Modified - name: Modified7409 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3810","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227624,7 +227624,7 @@ stage: Modified - name: Modified7410 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3811","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227643,7 +227643,7 @@ stage: Modified - name: Modified7411 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3812","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227662,7 +227662,7 @@ stage: Modified - name: Modified7412 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3813","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227681,7 +227681,7 @@ stage: Modified - name: Modified7413 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3814","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227700,7 +227700,7 @@ stage: Modified - name: Modified7414 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3815","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227719,63 +227719,63 @@ stage: Modified - name: Modified7415 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3824", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817008, "checksum": "d51a596b9f0ce4b518b4435fe6dae16d58001f44"}}' stage: Modified - name: Modified7416 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3825", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817008, "checksum": "d51a596b9f0ce4b518b4435fe6dae16d58001f44"}}' stage: Modified - name: Modified7417 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3826", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817008, "checksum": "d51a596b9f0ce4b518b4435fe6dae16d58001f44"}}' stage: Modified - name: Modified7418 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3827", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817008, "checksum": "d51a596b9f0ce4b518b4435fe6dae16d58001f44"}}' stage: Modified - name: Modified7419 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3828", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817008, "checksum": "d51a596b9f0ce4b518b4435fe6dae16d58001f44"}}' stage: Modified - name: Modified7420 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3829", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817008, "checksum": "d51a596b9f0ce4b518b4435fe6dae16d58001f44"}}' stage: Modified - name: Modified7421 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3830", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817008, "checksum": "d51a596b9f0ce4b518b4435fe6dae16d58001f44"}}' stage: Modified - name: Modified7422 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","mtime":1606817008,"checksum":"d51a596b9f0ce4b518b4435fe6dae16d58001f44"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723065,"checksum":"a9fa637dcbfa7e08a72e36fad8d946b019c5a9e1"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3831", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "mtime": 1606817008, "checksum": "d51a596b9f0ce4b518b4435fe6dae16d58001f44"}}' stage: Modified - name: Modified7423 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3840","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227795,7 +227795,7 @@ stage: Modified - name: Modified7424 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3841","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227815,7 +227815,7 @@ stage: Modified - name: Modified7425 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3842","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227835,7 +227835,7 @@ stage: Modified - name: Modified7426 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3843","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227855,7 +227855,7 @@ stage: Modified - name: Modified7427 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3844","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227875,7 +227875,7 @@ stage: Modified - name: Modified7428 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3845","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227895,7 +227895,7 @@ stage: Modified - name: Modified7429 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3846","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227915,7 +227915,7 @@ stage: Modified - name: Modified7430 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3847","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -227935,7 +227935,7 @@ stage: Modified - name: Modified7431 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3856", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227943,7 +227943,7 @@ stage: Modified - name: Modified7432 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3857", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227951,7 +227951,7 @@ stage: Modified - name: Modified7433 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3858", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227959,7 +227959,7 @@ stage: Modified - name: Modified7434 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3859", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227967,7 +227967,7 @@ stage: Modified - name: Modified7435 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3860", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227975,7 +227975,7 @@ stage: Modified - name: Modified7436 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3861", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227983,7 +227983,7 @@ stage: Modified - name: Modified7437 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3862", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227991,7 +227991,7 @@ stage: Modified - name: Modified7438 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817008,"checksum":"41700b1870187bcb9b6ecac892ad2227a6dead11"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723065,"checksum":"df1ea4cd087ab83aa49e1c8ee4168fec61ffeef3"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3863", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -227999,7 +227999,7 @@ stage: Modified - name: Modified7439 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3872","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228019,7 +228019,7 @@ stage: Modified - name: Modified7440 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3873","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228039,7 +228039,7 @@ stage: Modified - name: Modified7441 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3874","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228059,7 +228059,7 @@ stage: Modified - name: Modified7442 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3875","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228079,7 +228079,7 @@ stage: Modified - name: Modified7443 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3876","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228099,7 +228099,7 @@ stage: Modified - name: Modified7444 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3877","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228119,7 +228119,7 @@ stage: Modified - name: Modified7445 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3878","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228139,7 +228139,7 @@ stage: Modified - name: Modified7446 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3879","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228159,7 +228159,7 @@ stage: Modified - name: Modified7447 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3888", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -228167,7 +228167,7 @@ stage: Modified - name: Modified7448 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3889", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -228175,7 +228175,7 @@ stage: Modified - name: Modified7449 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3890", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -228183,7 +228183,7 @@ stage: Modified - name: Modified7450 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3891", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -228191,7 +228191,7 @@ stage: Modified - name: Modified7451 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3892", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -228199,7 +228199,7 @@ stage: Modified - name: Modified7452 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3893", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -228207,7 +228207,7 @@ stage: Modified - name: Modified7453 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3894", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -228215,7 +228215,7 @@ stage: Modified - name: Modified7454 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3895", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -228223,7 +228223,7 @@ stage: Modified - name: Modified7455 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3904","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228243,7 +228243,7 @@ stage: Modified - name: Modified7456 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3905","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228263,7 +228263,7 @@ stage: Modified - name: Modified7457 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3906","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228283,7 +228283,7 @@ stage: Modified - name: Modified7458 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3907","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228303,7 +228303,7 @@ stage: Modified - name: Modified7459 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3908","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228323,7 +228323,7 @@ stage: Modified - name: Modified7460 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3909","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228343,7 +228343,7 @@ stage: Modified - name: Modified7461 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3910","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228363,7 +228363,7 @@ stage: Modified - name: Modified7462 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3911","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228383,7 +228383,7 @@ stage: Modified - name: Modified7463 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3920", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -228391,7 +228391,7 @@ stage: Modified - name: Modified7464 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3921", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -228399,7 +228399,7 @@ stage: Modified - name: Modified7465 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3922", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -228407,7 +228407,7 @@ stage: Modified - name: Modified7466 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3923", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -228415,7 +228415,7 @@ stage: Modified - name: Modified7467 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3924", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -228423,7 +228423,7 @@ stage: Modified - name: Modified7468 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3925", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -228431,7 +228431,7 @@ stage: Modified - name: Modified7469 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3926", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -228439,7 +228439,7 @@ stage: Modified - name: Modified7470 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"8c7485e6d9611881e77fc36d1efe507280773637"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3927", "arch": "[x64]", "timestamp": 1606863819, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -228447,7 +228447,7 @@ stage: Modified - name: Modified7471 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3936","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228466,7 +228466,7 @@ stage: Modified - name: Modified7472 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3937","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863819,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228485,7 +228485,7 @@ stage: Modified - name: Modified7473 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3938","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228504,7 +228504,7 @@ stage: Modified - name: Modified7474 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3939","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228523,7 +228523,7 @@ stage: Modified - name: Modified7475 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3940","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228542,7 +228542,7 @@ stage: Modified - name: Modified7476 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3941","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228561,7 +228561,7 @@ stage: Modified - name: Modified7477 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3942","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228580,7 +228580,7 @@ stage: Modified - name: Modified7478 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3943","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228599,63 +228599,63 @@ stage: Modified - name: Modified7479 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3952", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817009, "checksum": "a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"}}' stage: Modified - name: Modified7480 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3953", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817009, "checksum": "a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"}}' stage: Modified - name: Modified7481 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3954", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817009, "checksum": "a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"}}' stage: Modified - name: Modified7482 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3955", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817009, "checksum": "a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"}}' stage: Modified - name: Modified7483 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3956", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817009, "checksum": "a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"}}' stage: Modified - name: Modified7484 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3957", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817009, "checksum": "a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"}}' stage: Modified - name: Modified7485 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3958", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817009, "checksum": "a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"}}' stage: Modified - name: Modified7486 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817009,"checksum":"a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723066,"checksum":"fc863fa3681a001c753de9d6de0877cd19165acd"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3959", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817009, "checksum": "a134e909f8599c1f8d5c30512853a5bbe4eb1ca0"}}' stage: Modified - name: Modified7487 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3968","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3968","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228675,7 +228675,7 @@ stage: Modified - name: Modified7488 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3969","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3969","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228695,7 +228695,7 @@ stage: Modified - name: Modified7489 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3970","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3970","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228715,7 +228715,7 @@ stage: Modified - name: Modified7490 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3971","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3971","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228735,7 +228735,7 @@ stage: Modified - name: Modified7491 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3972","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3972","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228755,7 +228755,7 @@ stage: Modified - name: Modified7492 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3973","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3973","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228775,7 +228775,7 @@ stage: Modified - name: Modified7493 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3974","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3974","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228795,7 +228795,7 @@ stage: Modified - name: Modified7494 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3975","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3975","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228815,7 +228815,7 @@ stage: Modified - name: Modified7495 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3984", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -228823,7 +228823,7 @@ stage: Modified - name: Modified7496 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3985", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -228831,7 +228831,7 @@ stage: Modified - name: Modified7497 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3986", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -228839,7 +228839,7 @@ stage: Modified - name: Modified7498 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3987", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -228847,7 +228847,7 @@ stage: Modified - name: Modified7499 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3988", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -228855,7 +228855,7 @@ stage: Modified - name: Modified7500 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3989", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -228863,7 +228863,7 @@ stage: Modified - name: Modified7501 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3990", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -228871,7 +228871,7 @@ stage: Modified - name: Modified7502 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817009,"checksum":"4b25d505d2dd31314e843eb5c91cc45bb67c3080"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"af4a31d6aa09e47cadf100671d3440ad82e0ece5"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3991", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "gid": "S-1-5-21-3527455827-79240758-596275861-513", @@ -228879,7 +228879,7 @@ stage: Modified - name: Modified7503 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4000","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4000","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228899,7 +228899,7 @@ stage: Modified - name: Modified7504 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4001","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4001","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228919,7 +228919,7 @@ stage: Modified - name: Modified7505 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4002","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4002","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228939,7 +228939,7 @@ stage: Modified - name: Modified7506 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4003","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4003","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228959,7 +228959,7 @@ stage: Modified - name: Modified7507 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4004","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4004","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228979,7 +228979,7 @@ stage: Modified - name: Modified7508 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4005","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4005","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -228999,7 +228999,7 @@ stage: Modified - name: Modified7509 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4006","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4006","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229019,7 +229019,7 @@ stage: Modified - name: Modified7510 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4007","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4007","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229039,7 +229039,7 @@ stage: Modified - name: Modified7511 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4016", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -229047,7 +229047,7 @@ stage: Modified - name: Modified7512 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4017", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -229055,7 +229055,7 @@ stage: Modified - name: Modified7513 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4018", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -229063,7 +229063,7 @@ stage: Modified - name: Modified7514 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4019", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -229071,7 +229071,7 @@ stage: Modified - name: Modified7515 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817009,"checksum":"f0c997d0c5e13aee83cf4704f271b37a16734e3c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4020", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817009, @@ -229079,7 +229079,7 @@ stage: Modified - name: Modified7516 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817010,"checksum":"ca1fad22ec8ffa89f0222039efd01a3350254395"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817010,"checksum":"ca1fad22ec8ffa89f0222039efd01a3350254395"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4021", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817010, @@ -229087,7 +229087,7 @@ stage: Modified - name: Modified7517 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817010,"checksum":"ca1fad22ec8ffa89f0222039efd01a3350254395"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817010,"checksum":"ca1fad22ec8ffa89f0222039efd01a3350254395"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4022", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817010, @@ -229095,7 +229095,7 @@ stage: Modified - name: Modified7518 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817010,"checksum":"ca1fad22ec8ffa89f0222039efd01a3350254395"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606817010,"checksum":"ca1fad22ec8ffa89f0222039efd01a3350254395"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","uid":"S-1-5-32-544","user_name":"Administradores","mtime":1606723066,"checksum":"fed81da534f137cce4cce24fc411ff3c78d5d816"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4023", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "uid": "S-1-5-32-544", "user_name": "Administradores", "mtime": 1606817010, @@ -229103,7 +229103,7 @@ stage: Modified - name: Modified7519 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4032","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4032","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229123,7 +229123,7 @@ stage: Modified - name: Modified7520 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4033","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4033","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229143,7 +229143,7 @@ stage: Modified - name: Modified7521 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4034","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4034","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229163,7 +229163,7 @@ stage: Modified - name: Modified7522 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4035","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4035","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229183,7 +229183,7 @@ stage: Modified - name: Modified7523 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4036","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4036","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229203,7 +229203,7 @@ stage: Modified - name: Modified7524 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4037","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4037","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229223,7 +229223,7 @@ stage: Modified - name: Modified7525 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4038","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4038","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229243,7 +229243,7 @@ stage: Modified - name: Modified7526 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4039","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4039","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229263,7 +229263,7 @@ stage: Modified - name: Modified7527 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4048", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -229271,7 +229271,7 @@ stage: Modified - name: Modified7528 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4049", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -229279,7 +229279,7 @@ stage: Modified - name: Modified7529 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4050", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -229287,7 +229287,7 @@ stage: Modified - name: Modified7530 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4051", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -229295,7 +229295,7 @@ stage: Modified - name: Modified7531 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4052", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -229303,7 +229303,7 @@ stage: Modified - name: Modified7532 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4053", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -229311,7 +229311,7 @@ stage: Modified - name: Modified7533 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4054", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -229319,7 +229319,7 @@ stage: Modified - name: Modified7534 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606817010,"checksum":"78f6fcd8a6c3cff07595532bce5d5b43fd44bd6c"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606723066,"checksum":"888d2f9bb0d0e281a1878aa901fe1fbd866371a2"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4055", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "gid": "S-1-5-21-3527455827-79240758-596275861-513", "group_name": "", "mtime": @@ -229327,7 +229327,7 @@ stage: Modified - name: Modified7535 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4064","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4064","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229346,7 +229346,7 @@ stage: Modified - name: Modified7536 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4065","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4065","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229365,7 +229365,7 @@ stage: Modified - name: Modified7537 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4066","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4066","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229384,7 +229384,7 @@ stage: Modified - name: Modified7538 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4067","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4067","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229403,7 +229403,7 @@ stage: Modified - name: Modified7539 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4068","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4068","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229422,7 +229422,7 @@ stage: Modified - name: Modified7540 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4069","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4069","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229441,7 +229441,7 @@ stage: Modified - name: Modified7541 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4070","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4070","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229460,7 +229460,7 @@ stage: Modified - name: Modified7542 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4071","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4071","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","perm":"Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Administradores (allowed): generic_all, SYSTEM (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229479,63 +229479,63 @@ stage: Modified - name: Modified7543 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4080", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817010, "checksum": "e0a678de216aa41dd7b926f6a432d56abba418fc"}}' stage: Modified - name: Modified7544 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4081", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817010, "checksum": "e0a678de216aa41dd7b926f6a432d56abba418fc"}}' stage: Modified - name: Modified7545 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4082", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817010, "checksum": "e0a678de216aa41dd7b926f6a432d56abba418fc"}}' stage: Modified - name: Modified7546 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4083", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817010, "checksum": "e0a678de216aa41dd7b926f6a432d56abba418fc"}}' stage: Modified - name: Modified7547 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4084", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817010, "checksum": "e0a678de216aa41dd7b926f6a432d56abba418fc"}}' stage: Modified - name: Modified7548 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4085", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817010, "checksum": "e0a678de216aa41dd7b926f6a432d56abba418fc"}}' stage: Modified - name: Modified7549 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"},"tags":"Sample"}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4086", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817010, "checksum": "e0a678de216aa41dd7b926f6a432d56abba418fc"}}' stage: Modified - name: Modified7550 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"modified","arch":"[x64]","timestamp":1606863820,"attributes":{"type":"registry_key","mtime":1606817010,"checksum":"e0a678de216aa41dd7b926f6a432d56abba418fc"},"changed_attributes":["mtime"],"old_attributes":{"type":"registry_key","mtime":1606723067,"checksum":"4b300f1404b94e4965eb720f00b6a2d6de3c697d"}}} output: 'agent 002 syscheck save2 {"path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4087", "arch": "[x64]", "timestamp": 1606863820, "attributes": {"type": "registry_key", "mtime": 1606817010, "checksum": "e0a678de216aa41dd7b926f6a432d56abba418fc"}}' stage: Modified - name: Deleted7551 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229545,12 +229545,12 @@ stage: Deleted - name: Deleted7552 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg0\\reg_key stage: Deleted - name: Deleted7553 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229560,12 +229560,12 @@ stage: Deleted - name: Deleted7554 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg1\\reg_key stage: Deleted - name: Deleted7555 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229575,12 +229575,12 @@ stage: Deleted - name: Deleted7556 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg2\\reg_key stage: Deleted - name: Deleted7557 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229590,12 +229590,12 @@ stage: Deleted - name: Deleted7558 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg3\\reg_key stage: Deleted - name: Deleted7559 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229605,12 +229605,12 @@ stage: Deleted - name: Deleted7560 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg4\\reg_key stage: Deleted - name: Deleted7561 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229620,12 +229620,12 @@ stage: Deleted - name: Deleted7562 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg5\\reg_key stage: Deleted - name: Deleted7563 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229635,12 +229635,12 @@ stage: Deleted - name: Deleted7564 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg6\\reg_key stage: Deleted - name: Deleted7565 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229650,12 +229650,12 @@ stage: Deleted - name: Deleted7566 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg7\\reg_key stage: Deleted - name: Deleted7567 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229665,12 +229665,12 @@ stage: Deleted - name: Deleted7568 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg8\\reg_key stage: Deleted - name: Deleted7569 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229680,12 +229680,12 @@ stage: Deleted - name: Deleted7570 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg9\\reg_key stage: Deleted - name: Deleted7571 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229695,12 +229695,12 @@ stage: Deleted - name: Deleted7572 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg10\\reg_key stage: Deleted - name: Deleted7573 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229710,12 +229710,12 @@ stage: Deleted - name: Deleted7574 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg11\\reg_key stage: Deleted - name: Deleted7575 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229725,12 +229725,12 @@ stage: Deleted - name: Deleted7576 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg12\\reg_key stage: Deleted - name: Deleted7577 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229740,12 +229740,12 @@ stage: Deleted - name: Deleted7578 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg13\\reg_key stage: Deleted - name: Deleted7579 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229755,12 +229755,12 @@ stage: Deleted - name: Deleted7580 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg14\\reg_key stage: Deleted - name: Deleted7581 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229770,172 +229770,172 @@ stage: Deleted - name: Deleted7582 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg15\\reg_key stage: Deleted - name: Deleted7583 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key stage: Deleted - name: Deleted7584 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg16\\reg_key stage: Deleted - name: Deleted7585 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key stage: Deleted - name: Deleted7586 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg17\\reg_key stage: Deleted - name: Deleted7587 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key stage: Deleted - name: Deleted7588 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg18\\reg_key stage: Deleted - name: Deleted7589 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key stage: Deleted - name: Deleted7590 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg19\\reg_key stage: Deleted - name: Deleted7591 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816861,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key stage: Deleted - name: Deleted7592 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816861,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg20\\reg_key stage: Deleted - name: Deleted7593 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key stage: Deleted - name: Deleted7594 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg21\\reg_key stage: Deleted - name: Deleted7595 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key stage: Deleted - name: Deleted7596 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg22\\reg_key stage: Deleted - name: Deleted7597 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769987,"checksum":"ea98a8aba623bc93bdce7735010bd0672a4cd7d3"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key stage: Deleted - name: Deleted7598 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg23\\reg_key stage: Deleted - name: Deleted7599 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key stage: Deleted - name: Deleted7600 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg24\\reg_key stage: Deleted - name: Deleted7601 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key stage: Deleted - name: Deleted7602 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg25\\reg_key stage: Deleted - name: Deleted7603 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key stage: Deleted - name: Deleted7604 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg26\\reg_key stage: Deleted - name: Deleted7605 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key stage: Deleted - name: Deleted7606 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg27\\reg_key stage: Deleted - name: Deleted7607 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key stage: Deleted - name: Deleted7608 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg28\\reg_key stage: Deleted - name: Deleted7609 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key stage: Deleted - name: Deleted7610 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg29\\reg_key stage: Deleted - name: Deleted7611 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key stage: Deleted - name: Deleted7612 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg30\\reg_key stage: Deleted - name: Deleted7613 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key stage: Deleted - name: Deleted7614 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg31\\reg_key stage: Deleted - name: Deleted7615 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229945,12 +229945,12 @@ stage: Deleted - name: Deleted7616 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg32\\reg_key stage: Deleted - name: Deleted7617 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229960,12 +229960,12 @@ stage: Deleted - name: Deleted7618 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg33\\reg_key stage: Deleted - name: Deleted7619 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229975,12 +229975,12 @@ stage: Deleted - name: Deleted7620 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg34\\reg_key stage: Deleted - name: Deleted7621 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -229990,12 +229990,12 @@ stage: Deleted - name: Deleted7622 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg35\\reg_key stage: Deleted - name: Deleted7623 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230005,12 +230005,12 @@ stage: Deleted - name: Deleted7624 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg36\\reg_key stage: Deleted - name: Deleted7625 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230020,12 +230020,12 @@ stage: Deleted - name: Deleted7626 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg37\\reg_key stage: Deleted - name: Deleted7627 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230035,12 +230035,12 @@ stage: Deleted - name: Deleted7628 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg38\\reg_key stage: Deleted - name: Deleted7629 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230050,12 +230050,12 @@ stage: Deleted - name: Deleted7630 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg39\\reg_key stage: Deleted - name: Deleted7631 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230065,12 +230065,12 @@ stage: Deleted - name: Deleted7632 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg40\\reg_key stage: Deleted - name: Deleted7633 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230080,12 +230080,12 @@ stage: Deleted - name: Deleted7634 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg41\\reg_key stage: Deleted - name: Deleted7635 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230095,12 +230095,12 @@ stage: Deleted - name: Deleted7636 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg42\\reg_key stage: Deleted - name: Deleted7637 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230110,12 +230110,12 @@ stage: Deleted - name: Deleted7638 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg43\\reg_key stage: Deleted - name: Deleted7639 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230125,12 +230125,12 @@ stage: Deleted - name: Deleted7640 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg44\\reg_key stage: Deleted - name: Deleted7641 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230140,12 +230140,12 @@ stage: Deleted - name: Deleted7642 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg45\\reg_key stage: Deleted - name: Deleted7643 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230155,12 +230155,12 @@ stage: Deleted - name: Deleted7644 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg46\\reg_key stage: Deleted - name: Deleted7645 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230170,172 +230170,172 @@ stage: Deleted - name: Deleted7646 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg47\\reg_key stage: Deleted - name: Deleted7647 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key stage: Deleted - name: Deleted7648 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg48\\reg_key stage: Deleted - name: Deleted7649 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key stage: Deleted - name: Deleted7650 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg49\\reg_key stage: Deleted - name: Deleted7651 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key stage: Deleted - name: Deleted7652 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg50\\reg_key stage: Deleted - name: Deleted7653 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key stage: Deleted - name: Deleted7654 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg51\\reg_key stage: Deleted - name: Deleted7655 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key stage: Deleted - name: Deleted7656 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg52\\reg_key stage: Deleted - name: Deleted7657 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key stage: Deleted - name: Deleted7658 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg53\\reg_key stage: Deleted - name: Deleted7659 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key stage: Deleted - name: Deleted7660 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg54\\reg_key stage: Deleted - name: Deleted7661 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769987,"checksum":"c6d6cfd7920dee0dcbc5d264631197cd0eaf3d0c"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key stage: Deleted - name: Deleted7662 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg55\\reg_key stage: Deleted - name: Deleted7663 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key stage: Deleted - name: Deleted7664 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg56\\reg_key stage: Deleted - name: Deleted7665 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816862,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key stage: Deleted - name: Deleted7666 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816862,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg57\\reg_key stage: Deleted - name: Deleted7667 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key stage: Deleted - name: Deleted7668 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg58\\reg_key stage: Deleted - name: Deleted7669 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key stage: Deleted - name: Deleted7670 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg59\\reg_key stage: Deleted - name: Deleted7671 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key stage: Deleted - name: Deleted7672 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg60\\reg_key stage: Deleted - name: Deleted7673 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key stage: Deleted - name: Deleted7674 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg61\\reg_key stage: Deleted - name: Deleted7675 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key stage: Deleted - name: Deleted7676 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg62\\reg_key stage: Deleted - name: Deleted7677 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key stage: Deleted - name: Deleted7678 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg63\\reg_key stage: Deleted - name: Deleted7679 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230345,12 +230345,12 @@ stage: Deleted - name: Deleted7680 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg64\\reg_key stage: Deleted - name: Deleted7681 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230360,12 +230360,12 @@ stage: Deleted - name: Deleted7682 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg65\\reg_key stage: Deleted - name: Deleted7683 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230375,12 +230375,12 @@ stage: Deleted - name: Deleted7684 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg66\\reg_key stage: Deleted - name: Deleted7685 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230390,12 +230390,12 @@ stage: Deleted - name: Deleted7686 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg67\\reg_key stage: Deleted - name: Deleted7687 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230405,12 +230405,12 @@ stage: Deleted - name: Deleted7688 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg68\\reg_key stage: Deleted - name: Deleted7689 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230420,12 +230420,12 @@ stage: Deleted - name: Deleted7690 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg69\\reg_key stage: Deleted - name: Deleted7691 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230435,12 +230435,12 @@ stage: Deleted - name: Deleted7692 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg70\\reg_key stage: Deleted - name: Deleted7693 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230450,12 +230450,12 @@ stage: Deleted - name: Deleted7694 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg71\\reg_key stage: Deleted - name: Deleted7695 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230465,12 +230465,12 @@ stage: Deleted - name: Deleted7696 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg72\\reg_key stage: Deleted - name: Deleted7697 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230480,12 +230480,12 @@ stage: Deleted - name: Deleted7698 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg73\\reg_key stage: Deleted - name: Deleted7699 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230495,12 +230495,12 @@ stage: Deleted - name: Deleted7700 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg74\\reg_key stage: Deleted - name: Deleted7701 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230510,12 +230510,12 @@ stage: Deleted - name: Deleted7702 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg75\\reg_key stage: Deleted - name: Deleted7703 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230525,12 +230525,12 @@ stage: Deleted - name: Deleted7704 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg76\\reg_key stage: Deleted - name: Deleted7705 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230540,12 +230540,12 @@ stage: Deleted - name: Deleted7706 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg77\\reg_key stage: Deleted - name: Deleted7707 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230555,12 +230555,12 @@ stage: Deleted - name: Deleted7708 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg78\\reg_key stage: Deleted - name: Deleted7709 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230570,172 +230570,172 @@ stage: Deleted - name: Deleted7710 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg79\\reg_key stage: Deleted - name: Deleted7711 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key stage: Deleted - name: Deleted7712 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg80\\reg_key stage: Deleted - name: Deleted7713 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key stage: Deleted - name: Deleted7714 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg81\\reg_key stage: Deleted - name: Deleted7715 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key stage: Deleted - name: Deleted7716 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg82\\reg_key stage: Deleted - name: Deleted7717 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key stage: Deleted - name: Deleted7718 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg83\\reg_key stage: Deleted - name: Deleted7719 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key stage: Deleted - name: Deleted7720 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg84\\reg_key stage: Deleted - name: Deleted7721 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key stage: Deleted - name: Deleted7722 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg85\\reg_key stage: Deleted - name: Deleted7723 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key stage: Deleted - name: Deleted7724 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg86\\reg_key stage: Deleted - name: Deleted7725 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816863,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769988,"checksum":"10137b53e20161fbea31fcd867d81ac5756beeae"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key stage: Deleted - name: Deleted7726 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg87\\reg_key stage: Deleted - name: Deleted7727 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key stage: Deleted - name: Deleted7728 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg88\\reg_key stage: Deleted - name: Deleted7729 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key stage: Deleted - name: Deleted7730 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg89\\reg_key stage: Deleted - name: Deleted7731 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key stage: Deleted - name: Deleted7732 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg90\\reg_key stage: Deleted - name: Deleted7733 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key stage: Deleted - name: Deleted7734 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg91\\reg_key stage: Deleted - name: Deleted7735 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key stage: Deleted - name: Deleted7736 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg92\\reg_key stage: Deleted - name: Deleted7737 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key stage: Deleted - name: Deleted7738 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816863,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg93\\reg_key stage: Deleted - name: Deleted7739 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key stage: Deleted - name: Deleted7740 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg94\\reg_key stage: Deleted - name: Deleted7741 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key stage: Deleted - name: Deleted7742 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg95\\reg_key stage: Deleted - name: Deleted7743 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230745,12 +230745,12 @@ stage: Deleted - name: Deleted7744 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg96\\reg_key stage: Deleted - name: Deleted7745 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230760,12 +230760,12 @@ stage: Deleted - name: Deleted7746 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg97\\reg_key stage: Deleted - name: Deleted7747 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230775,12 +230775,12 @@ stage: Deleted - name: Deleted7748 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg98\\reg_key stage: Deleted - name: Deleted7749 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230790,12 +230790,12 @@ stage: Deleted - name: Deleted7750 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg99\\reg_key stage: Deleted - name: Deleted7751 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230805,12 +230805,12 @@ stage: Deleted - name: Deleted7752 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg100\\reg_key stage: Deleted - name: Deleted7753 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230820,12 +230820,12 @@ stage: Deleted - name: Deleted7754 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg101\\reg_key stage: Deleted - name: Deleted7755 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230835,12 +230835,12 @@ stage: Deleted - name: Deleted7756 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg102\\reg_key stage: Deleted - name: Deleted7757 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230850,12 +230850,12 @@ stage: Deleted - name: Deleted7758 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg103\\reg_key stage: Deleted - name: Deleted7759 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230865,12 +230865,12 @@ stage: Deleted - name: Deleted7760 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg104\\reg_key stage: Deleted - name: Deleted7761 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230880,12 +230880,12 @@ stage: Deleted - name: Deleted7762 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg105\\reg_key stage: Deleted - name: Deleted7763 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230895,12 +230895,12 @@ stage: Deleted - name: Deleted7764 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg106\\reg_key stage: Deleted - name: Deleted7765 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230910,12 +230910,12 @@ stage: Deleted - name: Deleted7766 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg107\\reg_key stage: Deleted - name: Deleted7767 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230925,12 +230925,12 @@ stage: Deleted - name: Deleted7768 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg108\\reg_key stage: Deleted - name: Deleted7769 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230940,12 +230940,12 @@ stage: Deleted - name: Deleted7770 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg109\\reg_key stage: Deleted - name: Deleted7771 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230955,12 +230955,12 @@ stage: Deleted - name: Deleted7772 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg110\\reg_key stage: Deleted - name: Deleted7773 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -230970,172 +230970,172 @@ stage: Deleted - name: Deleted7774 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg111\\reg_key stage: Deleted - name: Deleted7775 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key stage: Deleted - name: Deleted7776 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg112\\reg_key stage: Deleted - name: Deleted7777 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key stage: Deleted - name: Deleted7778 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg113\\reg_key stage: Deleted - name: Deleted7779 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key stage: Deleted - name: Deleted7780 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg114\\reg_key stage: Deleted - name: Deleted7781 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key stage: Deleted - name: Deleted7782 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg115\\reg_key stage: Deleted - name: Deleted7783 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key stage: Deleted - name: Deleted7784 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg116\\reg_key stage: Deleted - name: Deleted7785 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key stage: Deleted - name: Deleted7786 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg117\\reg_key stage: Deleted - name: Deleted7787 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key stage: Deleted - name: Deleted7788 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg118\\reg_key stage: Deleted - name: Deleted7789 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","mtime":1606769988,"checksum":"f3a6f4be7db15cac53f79b5e76543870a8c31a6b"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key stage: Deleted - name: Deleted7790 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg119\\reg_key stage: Deleted - name: Deleted7791 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key stage: Deleted - name: Deleted7792 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg120\\reg_key stage: Deleted - name: Deleted7793 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key stage: Deleted - name: Deleted7794 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg121\\reg_key stage: Deleted - name: Deleted7795 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key stage: Deleted - name: Deleted7796 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg122\\reg_key stage: Deleted - name: Deleted7797 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key stage: Deleted - name: Deleted7798 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg123\\reg_key stage: Deleted - name: Deleted7799 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key stage: Deleted - name: Deleted7800 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg124\\reg_key stage: Deleted - name: Deleted7801 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key stage: Deleted - name: Deleted7802 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg125\\reg_key stage: Deleted - name: Deleted7803 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key stage: Deleted - name: Deleted7804 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg126\\reg_key stage: Deleted - name: Deleted7805 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769868,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key stage: Deleted - name: Deleted7806 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg127\\reg_key stage: Deleted - name: Deleted7807 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231145,12 +231145,12 @@ stage: Deleted - name: Deleted7808 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg128\\reg_key stage: Deleted - name: Deleted7809 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816864,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231160,12 +231160,12 @@ stage: Deleted - name: Deleted7810 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816864,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg129\\reg_key stage: Deleted - name: Deleted7811 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231175,12 +231175,12 @@ stage: Deleted - name: Deleted7812 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg130\\reg_key stage: Deleted - name: Deleted7813 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231190,12 +231190,12 @@ stage: Deleted - name: Deleted7814 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg131\\reg_key stage: Deleted - name: Deleted7815 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231205,12 +231205,12 @@ stage: Deleted - name: Deleted7816 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg132\\reg_key stage: Deleted - name: Deleted7817 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231220,12 +231220,12 @@ stage: Deleted - name: Deleted7818 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg133\\reg_key stage: Deleted - name: Deleted7819 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231235,12 +231235,12 @@ stage: Deleted - name: Deleted7820 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg134\\reg_key stage: Deleted - name: Deleted7821 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231250,12 +231250,12 @@ stage: Deleted - name: Deleted7822 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg135\\reg_key stage: Deleted - name: Deleted7823 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231265,12 +231265,12 @@ stage: Deleted - name: Deleted7824 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg136\\reg_key stage: Deleted - name: Deleted7825 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231280,12 +231280,12 @@ stage: Deleted - name: Deleted7826 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg137\\reg_key stage: Deleted - name: Deleted7827 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231295,12 +231295,12 @@ stage: Deleted - name: Deleted7828 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg138\\reg_key stage: Deleted - name: Deleted7829 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231310,12 +231310,12 @@ stage: Deleted - name: Deleted7830 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg139\\reg_key stage: Deleted - name: Deleted7831 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231325,12 +231325,12 @@ stage: Deleted - name: Deleted7832 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg140\\reg_key stage: Deleted - name: Deleted7833 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231340,12 +231340,12 @@ stage: Deleted - name: Deleted7834 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg141\\reg_key stage: Deleted - name: Deleted7835 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231355,12 +231355,12 @@ stage: Deleted - name: Deleted7836 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg142\\reg_key stage: Deleted - name: Deleted7837 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231370,172 +231370,172 @@ stage: Deleted - name: Deleted7838 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg143\\reg_key stage: Deleted - name: Deleted7839 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key stage: Deleted - name: Deleted7840 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg144\\reg_key stage: Deleted - name: Deleted7841 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key stage: Deleted - name: Deleted7842 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg145\\reg_key stage: Deleted - name: Deleted7843 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key stage: Deleted - name: Deleted7844 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg146\\reg_key stage: Deleted - name: Deleted7845 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key stage: Deleted - name: Deleted7846 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg147\\reg_key stage: Deleted - name: Deleted7847 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key stage: Deleted - name: Deleted7848 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg148\\reg_key stage: Deleted - name: Deleted7849 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key stage: Deleted - name: Deleted7850 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg149\\reg_key stage: Deleted - name: Deleted7851 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key stage: Deleted - name: Deleted7852 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg150\\reg_key stage: Deleted - name: Deleted7853 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"29391a9d651012be048bda8c3a010a8d1227a411"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key stage: Deleted - name: Deleted7854 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg151\\reg_key stage: Deleted - name: Deleted7855 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key stage: Deleted - name: Deleted7856 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg152\\reg_key stage: Deleted - name: Deleted7857 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key stage: Deleted - name: Deleted7858 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg153\\reg_key stage: Deleted - name: Deleted7859 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key stage: Deleted - name: Deleted7860 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg154\\reg_key stage: Deleted - name: Deleted7861 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key stage: Deleted - name: Deleted7862 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg155\\reg_key stage: Deleted - name: Deleted7863 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key stage: Deleted - name: Deleted7864 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg156\\reg_key stage: Deleted - name: Deleted7865 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key stage: Deleted - name: Deleted7866 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg157\\reg_key stage: Deleted - name: Deleted7867 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key stage: Deleted - name: Deleted7868 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg158\\reg_key stage: Deleted - name: Deleted7869 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"0ab084fcbdb899506ad91d08910f3e305dc2b612"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key stage: Deleted - name: Deleted7870 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg159\\reg_key stage: Deleted - name: Deleted7871 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231545,12 +231545,12 @@ stage: Deleted - name: Deleted7872 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg160\\reg_key stage: Deleted - name: Deleted7873 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231560,12 +231560,12 @@ stage: Deleted - name: Deleted7874 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg161\\reg_key stage: Deleted - name: Deleted7875 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231575,12 +231575,12 @@ stage: Deleted - name: Deleted7876 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg162\\reg_key stage: Deleted - name: Deleted7877 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231590,12 +231590,12 @@ stage: Deleted - name: Deleted7878 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg163\\reg_key stage: Deleted - name: Deleted7879 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231605,12 +231605,12 @@ stage: Deleted - name: Deleted7880 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg164\\reg_key stage: Deleted - name: Deleted7881 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816865,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231620,12 +231620,12 @@ stage: Deleted - name: Deleted7882 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816865,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg165\\reg_key stage: Deleted - name: Deleted7883 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231635,12 +231635,12 @@ stage: Deleted - name: Deleted7884 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg166\\reg_key stage: Deleted - name: Deleted7885 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231650,12 +231650,12 @@ stage: Deleted - name: Deleted7886 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg167\\reg_key stage: Deleted - name: Deleted7887 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231665,12 +231665,12 @@ stage: Deleted - name: Deleted7888 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg168\\reg_key stage: Deleted - name: Deleted7889 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231680,12 +231680,12 @@ stage: Deleted - name: Deleted7890 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg169\\reg_key stage: Deleted - name: Deleted7891 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231695,12 +231695,12 @@ stage: Deleted - name: Deleted7892 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg170\\reg_key stage: Deleted - name: Deleted7893 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231710,12 +231710,12 @@ stage: Deleted - name: Deleted7894 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg171\\reg_key stage: Deleted - name: Deleted7895 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231725,12 +231725,12 @@ stage: Deleted - name: Deleted7896 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg172\\reg_key stage: Deleted - name: Deleted7897 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231740,12 +231740,12 @@ stage: Deleted - name: Deleted7898 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg173\\reg_key stage: Deleted - name: Deleted7899 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231755,12 +231755,12 @@ stage: Deleted - name: Deleted7900 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg174\\reg_key stage: Deleted - name: Deleted7901 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231770,172 +231770,172 @@ stage: Deleted - name: Deleted7902 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg175\\reg_key stage: Deleted - name: Deleted7903 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key stage: Deleted - name: Deleted7904 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg176\\reg_key stage: Deleted - name: Deleted7905 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key stage: Deleted - name: Deleted7906 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg177\\reg_key stage: Deleted - name: Deleted7907 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key stage: Deleted - name: Deleted7908 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg178\\reg_key stage: Deleted - name: Deleted7909 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key stage: Deleted - name: Deleted7910 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg179\\reg_key stage: Deleted - name: Deleted7911 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key stage: Deleted - name: Deleted7912 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg180\\reg_key stage: Deleted - name: Deleted7913 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key stage: Deleted - name: Deleted7914 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg181\\reg_key stage: Deleted - name: Deleted7915 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key stage: Deleted - name: Deleted7916 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg182\\reg_key stage: Deleted - name: Deleted7917 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","mtime":1606769989,"checksum":"856a1686ab0834d1c22b91beee0a5c9eca51042a"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key stage: Deleted - name: Deleted7918 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg183\\reg_key stage: Deleted - name: Deleted7919 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key stage: Deleted - name: Deleted7920 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg184\\reg_key stage: Deleted - name: Deleted7921 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key stage: Deleted - name: Deleted7922 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg185\\reg_key stage: Deleted - name: Deleted7923 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key stage: Deleted - name: Deleted7924 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg186\\reg_key stage: Deleted - name: Deleted7925 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key stage: Deleted - name: Deleted7926 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg187\\reg_key stage: Deleted - name: Deleted7927 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key stage: Deleted - name: Deleted7928 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg188\\reg_key stage: Deleted - name: Deleted7929 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key stage: Deleted - name: Deleted7930 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg189\\reg_key stage: Deleted - name: Deleted7931 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key stage: Deleted - name: Deleted7932 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg190\\reg_key stage: Deleted - name: Deleted7933 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","uid":"S-1-5-21-3527455827-79240758-596275861-1001","user_name":"jmv74211","checksum":"edbfdfab10392649f54887374162cc8eec7206e9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key stage: Deleted - name: Deleted7934 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg191\\reg_key stage: Deleted - name: Deleted7935 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231945,12 +231945,12 @@ stage: Deleted - name: Deleted7936 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg192\\reg_key stage: Deleted - name: Deleted7937 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231960,12 +231960,12 @@ stage: Deleted - name: Deleted7938 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg193\\reg_key stage: Deleted - name: Deleted7939 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231975,12 +231975,12 @@ stage: Deleted - name: Deleted7940 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg194\\reg_key stage: Deleted - name: Deleted7941 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -231990,12 +231990,12 @@ stage: Deleted - name: Deleted7942 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg195\\reg_key stage: Deleted - name: Deleted7943 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232005,12 +232005,12 @@ stage: Deleted - name: Deleted7944 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg196\\reg_key stage: Deleted - name: Deleted7945 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232020,12 +232020,12 @@ stage: Deleted - name: Deleted7946 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg197\\reg_key stage: Deleted - name: Deleted7947 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232035,12 +232035,12 @@ stage: Deleted - name: Deleted7948 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg198\\reg_key stage: Deleted - name: Deleted7949 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816866,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232050,12 +232050,12 @@ stage: Deleted - name: Deleted7950 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816866,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg199\\reg_key stage: Deleted - name: Deleted7951 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232065,12 +232065,12 @@ stage: Deleted - name: Deleted7952 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg200\\reg_key stage: Deleted - name: Deleted7953 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232080,12 +232080,12 @@ stage: Deleted - name: Deleted7954 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg201\\reg_key stage: Deleted - name: Deleted7955 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232095,12 +232095,12 @@ stage: Deleted - name: Deleted7956 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg202\\reg_key stage: Deleted - name: Deleted7957 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232110,12 +232110,12 @@ stage: Deleted - name: Deleted7958 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg203\\reg_key stage: Deleted - name: Deleted7959 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232125,12 +232125,12 @@ stage: Deleted - name: Deleted7960 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg204\\reg_key stage: Deleted - name: Deleted7961 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232140,12 +232140,12 @@ stage: Deleted - name: Deleted7962 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg205\\reg_key stage: Deleted - name: Deleted7963 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232155,12 +232155,12 @@ stage: Deleted - name: Deleted7964 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg206\\reg_key stage: Deleted - name: Deleted7965 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232170,172 +232170,172 @@ stage: Deleted - name: Deleted7966 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg207\\reg_key stage: Deleted - name: Deleted7967 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key stage: Deleted - name: Deleted7968 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg208\\reg_key stage: Deleted - name: Deleted7969 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key stage: Deleted - name: Deleted7970 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg209\\reg_key stage: Deleted - name: Deleted7971 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key stage: Deleted - name: Deleted7972 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg210\\reg_key stage: Deleted - name: Deleted7973 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key stage: Deleted - name: Deleted7974 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg211\\reg_key stage: Deleted - name: Deleted7975 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key stage: Deleted - name: Deleted7976 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg212\\reg_key stage: Deleted - name: Deleted7977 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key stage: Deleted - name: Deleted7978 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg213\\reg_key stage: Deleted - name: Deleted7979 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key stage: Deleted - name: Deleted7980 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg214\\reg_key stage: Deleted - name: Deleted7981 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","mtime":1606769989,"checksum":"a2ef7830159bfbc2b43c691791c54ea4b16a65b6"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key stage: Deleted - name: Deleted7982 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg215\\reg_key stage: Deleted - name: Deleted7983 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key stage: Deleted - name: Deleted7984 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg216\\reg_key stage: Deleted - name: Deleted7985 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key stage: Deleted - name: Deleted7986 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg217\\reg_key stage: Deleted - name: Deleted7987 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key stage: Deleted - name: Deleted7988 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg218\\reg_key stage: Deleted - name: Deleted7989 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key stage: Deleted - name: Deleted7990 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg219\\reg_key stage: Deleted - name: Deleted7991 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key stage: Deleted - name: Deleted7992 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg220\\reg_key stage: Deleted - name: Deleted7993 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key stage: Deleted - name: Deleted7994 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg221\\reg_key stage: Deleted - name: Deleted7995 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key stage: Deleted - name: Deleted7996 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg222\\reg_key stage: Deleted - name: Deleted7997 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","gid":"S-1-5-21-3527455827-79240758-596275861-513","group_name":"","checksum":"5464a0dd9782f5cae2e0f411db0f784415a978f4"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key stage: Deleted - name: Deleted7998 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg223\\reg_key stage: Deleted - name: Deleted7999 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232345,12 +232345,12 @@ stage: Deleted - name: Deleted8000 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg224\\reg_key stage: Deleted - name: Deleted8001 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232360,12 +232360,12 @@ stage: Deleted - name: Deleted8002 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg225\\reg_key stage: Deleted - name: Deleted8003 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232375,12 +232375,12 @@ stage: Deleted - name: Deleted8004 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg226\\reg_key stage: Deleted - name: Deleted8005 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232390,12 +232390,12 @@ stage: Deleted - name: Deleted8006 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg227\\reg_key stage: Deleted - name: Deleted8007 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232405,12 +232405,12 @@ stage: Deleted - name: Deleted8008 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg228\\reg_key stage: Deleted - name: Deleted8009 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232420,12 +232420,12 @@ stage: Deleted - name: Deleted8010 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg229\\reg_key stage: Deleted - name: Deleted8011 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232435,12 +232435,12 @@ stage: Deleted - name: Deleted8012 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg230\\reg_key stage: Deleted - name: Deleted8013 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232450,12 +232450,12 @@ stage: Deleted - name: Deleted8014 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg231\\reg_key stage: Deleted - name: Deleted8015 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232465,12 +232465,12 @@ stage: Deleted - name: Deleted8016 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg232\\reg_key stage: Deleted - name: Deleted8017 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232480,12 +232480,12 @@ stage: Deleted - name: Deleted8018 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg233\\reg_key stage: Deleted - name: Deleted8019 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232495,12 +232495,12 @@ stage: Deleted - name: Deleted8020 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg234\\reg_key stage: Deleted - name: Deleted8021 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232510,12 +232510,12 @@ stage: Deleted - name: Deleted8022 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg235\\reg_key stage: Deleted - name: Deleted8023 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816867,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232525,12 +232525,12 @@ stage: Deleted - name: Deleted8024 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816867,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg236\\reg_key stage: Deleted - name: Deleted8025 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232540,12 +232540,12 @@ stage: Deleted - name: Deleted8026 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg237\\reg_key stage: Deleted - name: Deleted8027 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232555,12 +232555,12 @@ stage: Deleted - name: Deleted8028 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg238\\reg_key stage: Deleted - name: Deleted8029 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232570,172 +232570,172 @@ stage: Deleted - name: Deleted8030 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg239\\reg_key stage: Deleted - name: Deleted8031 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key stage: Deleted - name: Deleted8032 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg240\\reg_key stage: Deleted - name: Deleted8033 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key stage: Deleted - name: Deleted8034 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg241\\reg_key stage: Deleted - name: Deleted8035 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key stage: Deleted - name: Deleted8036 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg242\\reg_key stage: Deleted - name: Deleted8037 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key stage: Deleted - name: Deleted8038 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg243\\reg_key stage: Deleted - name: Deleted8039 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key stage: Deleted - name: Deleted8040 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg244\\reg_key stage: Deleted - name: Deleted8041 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key stage: Deleted - name: Deleted8042 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg245\\reg_key stage: Deleted - name: Deleted8043 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key stage: Deleted - name: Deleted8044 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg246\\reg_key stage: Deleted - name: Deleted8045 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","mtime":1606769990,"checksum":"64c908843f85040653cea0e66cb9bfd6176e5214"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key stage: Deleted - name: Deleted8046 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg247\\reg_key stage: Deleted - name: Deleted8047 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key stage: Deleted - name: Deleted8048 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg248\\reg_key stage: Deleted - name: Deleted8049 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key stage: Deleted - name: Deleted8050 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg249\\reg_key stage: Deleted - name: Deleted8051 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key stage: Deleted - name: Deleted8052 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg250\\reg_key stage: Deleted - name: Deleted8053 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key stage: Deleted - name: Deleted8054 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg251\\reg_key stage: Deleted - name: Deleted8055 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key stage: Deleted - name: Deleted8056 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg252\\reg_key stage: Deleted - name: Deleted8057 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key stage: Deleted - name: Deleted8058 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg253\\reg_key stage: Deleted - name: Deleted8059 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key stage: Deleted - name: Deleted8060 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg254\\reg_key stage: Deleted - name: Deleted8061 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606769869,"attributes":{"type":"registry_key","checksum":"16aa83a99015dbfa28bf035d6dfdf35389f4e042"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key stage: Deleted - name: Deleted8062 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","hash_sha256":"b80012851cf027c6d8adda328907d400c95773958fb4fec3e544a02cd5eeab0e","checksum":"cf82e13cd27d163a303185c6e188f055540c68b8"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg255\\reg_key stage: Deleted - name: Deleted8063 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232745,12 +232745,12 @@ stage: Deleted - name: Deleted8064 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg256\\reg_key stage: Deleted - name: Deleted8065 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232760,12 +232760,12 @@ stage: Deleted - name: Deleted8066 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg257\\reg_key stage: Deleted - name: Deleted8067 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232775,12 +232775,12 @@ stage: Deleted - name: Deleted8068 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg258\\reg_key stage: Deleted - name: Deleted8069 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232790,12 +232790,12 @@ stage: Deleted - name: Deleted8070 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg259\\reg_key stage: Deleted - name: Deleted8071 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232805,12 +232805,12 @@ stage: Deleted - name: Deleted8072 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg260\\reg_key stage: Deleted - name: Deleted8073 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232820,12 +232820,12 @@ stage: Deleted - name: Deleted8074 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg261\\reg_key stage: Deleted - name: Deleted8075 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232835,12 +232835,12 @@ stage: Deleted - name: Deleted8076 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg262\\reg_key stage: Deleted - name: Deleted8077 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232850,12 +232850,12 @@ stage: Deleted - name: Deleted8078 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg263\\reg_key stage: Deleted - name: Deleted8079 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232865,12 +232865,12 @@ stage: Deleted - name: Deleted8080 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg264\\reg_key stage: Deleted - name: Deleted8081 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232880,12 +232880,12 @@ stage: Deleted - name: Deleted8082 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg265\\reg_key stage: Deleted - name: Deleted8083 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232895,12 +232895,12 @@ stage: Deleted - name: Deleted8084 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"},"tags":"Sample"}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg266\\reg_key stage: Deleted - name: Deleted8085 test_case: - - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 + - input: '8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","timestamp":1606816868,"attributes":{"type":"registry_key","perm":"jmv74211 (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, Usuarios (allowed): read_control|read_data|read_ea|write_ea, Usuarios (allowed): generic_read, Administradores (allowed): delete|read_control|write_dac|write_owner|read_data|write_data|append_data|read_ea|write_ea|execute, @@ -232910,6 +232910,6 @@ stage: Deleted - name: Deleted8086 test_case: - - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} + - input: 8:[002] (jmv74211-PC) any->syscheck:{"type":"event","data":{"path":"HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key","index":"234567890ABCDEF1234567890ABCDEF123456111","mode":"scheduled","type":"deleted","arch":"[x64]","value_name":"value_name","timestamp":1606816868,"attributes":{"type":"registry_value","value_type":"REG_SZ","size":9,"hash_md5":"9ae73c65f418e6f79ceb4f0e4a4b98d5","hash_sha1":"99db324742823c55d975b605e1fc22f4253a9b7d","checksum":"8134521f8e28d195a686b167209f8cacecfbf5f9"}}} output: agent 002 syscheck delete HKEY_LOCAL_MACHINE\\SOFTWARE\\testreg267\\reg_key stage: Deleted From c24e533d072a961916890859064e484ca64b8ca6 Mon Sep 17 00:00:00 2001 From: jnasselle Date: Wed, 3 May 2023 16:51:37 -0300 Subject: [PATCH 30/34] fix(#4152): fix boto3 version requirement --- CHANGELOG.md | 1 + requirements.txt | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3dcbc63636..8071886a3f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -34,6 +34,7 @@ All notable changes to this project will be documented in this file. ### Fixed +- Fix boto3 version requirement for legacy OS ([#4150](https://github.com/wazuh/wazuh-qa/pull/4150)) \- (Framework) - Fix cases yaml of the analysisd windows registry IT ([#4149](https://github.com/wazuh/wazuh-qa/pull/4149)) \- (Tests) - Fix a bug in on Migration tool's library ([#4106](https://github.com/wazuh/wazuh-qa/pull/4106)) \- (Framework) - Fix imports and add windows support for test_report_changes_and_diff IT ([#3548](https://github.com/wazuh/wazuh-qa/issues/3548)) \- (Framework + Tests) diff --git a/requirements.txt b/requirements.txt index 92f341ddb2..a45e0f0006 100644 --- a/requirements.txt +++ b/requirements.txt @@ -50,4 +50,4 @@ treelib==1.6.1 prettytable; platform_system == "Linux" mysql-connector-python==8.0.32; platform_system == 'Linux' and python_version >= '3.7' protobuf>=3.11.0,<=3.20.3; platform_system == 'Linux' and python_version >= '3.7' -boto3==1.26.11; platform_system == 'Linux' +boto3>=1.17.85; platform_system == 'Linux' From 56763d3c47a1cf62552c33bd4edb69b9f3a7d2a6 Mon Sep 17 00:00:00 2001 From: jnasselle Date: Tue, 9 May 2023 15:47:21 -0300 Subject: [PATCH 31/34] fix(#4162): limit urllib3 major --- CHANGELOG.md | 1 + requirements.txt | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2e3f10aeca..e63d71791c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ All notable changes to this project will be documented in this file. ### Fixed +- Limit urllib3 major required version ([#4162](https://github.com/wazuh/wazuh-qa/pull/4162)) \- (Framework) - Fix daemons_handler fixture (fix GCP IT) ([#4134](https://github.com/wazuh/wazuh-qa/pull/4134)) \- (Tests) - Fix wazuhdb IT. ([#3584](https://github.com/wazuh/wazuh-qa/pull/3584)) \- (Framework + Tests) - Fix agentd IT for python3.10 AMI ([#3973](https://github.com/wazuh/wazuh-qa/pull/3973)) \- (Tests) diff --git a/requirements.txt b/requirements.txt index 846bd489af..b4efd453de 100644 --- a/requirements.txt +++ b/requirements.txt @@ -32,7 +32,7 @@ testinfra==5.0.0 jq==1.1.2 ; (platform_system == "Linux" or platform_system == "Darwin") and python_version <= "3.9" jq==1.2.2 ; (platform_system == "Linux" or platform_system == "Darwin") and python_version >= "3.10" cryptography==3.3.2; platform_system == "Linux" or platform_system == "Darwin" or platform_system=='Windows' -urllib3>=1.26.5 +urllib3>=1.26.5,<2 numpydoc>=1.1.0 ansible-runner>=2.0.1 ; platform_system == "Linux" docker>=5.0.0 ; platform_system == "Linux" or platform_system=='Windows' From a575ce81cfb2677573577bc062d17cdfd8891669 Mon Sep 17 00:00:00 2001 From: Juan Nicolas Asselle Date: Tue, 16 May 2023 14:40:30 -0300 Subject: [PATCH 32/34] fix(#4162): limit urllib3 major (#4174) --- CHANGELOG.md | 1 + requirements.txt | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8071886a3f..7ce7297dcf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,7 @@ All notable changes to this project will be documented in this file. ### Fixed +- Limit urllib3 major required version ([#4162](https://github.com/wazuh/wazuh-qa/pull/4162)) \- (Framework) - Fix daemons_handler fixture (fix GCP IT) ([#4134](https://github.com/wazuh/wazuh-qa/pull/4134)) \- (Tests) - Fix wazuhdb IT. ([#3584](https://github.com/wazuh/wazuh-qa/pull/3584)) \- (Framework + Tests) - Fix agentd IT for python3.10 AMI ([#3973](https://github.com/wazuh/wazuh-qa/pull/3973)) \- (Tests) diff --git a/requirements.txt b/requirements.txt index a45e0f0006..f6619465bd 100644 --- a/requirements.txt +++ b/requirements.txt @@ -32,7 +32,7 @@ testinfra==5.0.0 jq==1.1.2 ; (platform_system == "Linux" or platform_system == "Darwin") and python_version <= "3.9" jq==1.2.2 ; (platform_system == "Linux" or platform_system == "Darwin") and python_version >= "3.10" cryptography==3.3.2; platform_system == "Linux" or platform_system == "Darwin" or platform_system=='Windows' -urllib3>=1.26.5 +urllib3>=1.26.5,<2 numpydoc>=1.1.0 ansible-runner>=2.0.1 ; platform_system == "Linux" docker>=5.0.0 ; platform_system == "Linux" or platform_system=='Windows' From 75b5e97a39ea5f3fc06176786895446ca7b223b0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9s=20Carmelo=20Micalizzi=20Casali?= Date: Tue, 23 May 2023 08:22:16 -0300 Subject: [PATCH 33/34] Enhance FIM IT test_ambiguous_confs suite (#4121) * fix(#3591): fix registry checker * feat(#3591): add new fim callbacks * fix(#3591): fix create_monitored_folders fixture * refactor(#3591): update ambiguous_confs modules * fix(#3591): fix flaky tests * fix(#3591): skip test for Issue #4077 * docs(#3591): update changelog.md * fix(#3591): fix imports * style(#3591): fix indents and spacing * style(#3591): fix indents and spacing * fix(#3591): fix timeout import * fix(#3591): replace xfail for skip in scheduled IT * docs(#3591): change skipped tests reason parameter * docs(#3591): updated documentation * docs(#3591): improved test cases names * docs(#3591): updated documentation * docs(#3591): improve create_registry logger * fix(#3591): add markers to refactored tests --- CHANGELOG.md | 2 +- .../wazuh_testing/modules/fim/classes.py | 4 +- .../modules/fim/event_monitor.py | 54 ++++-- .../wazuh_testing/modules/fim/utils.py | 9 +- tests/integration/test_fim/conftest.py | 12 +- ...figuration_ignore_works_over_restrict.yaml | 42 +++++ ...tion_ignore_works_over_restrict_win32.yaml | 42 +++++ ...ration_whodata_prevails_over_realtime.yaml | 27 +++ .../configuration_whodata_thread.yaml | 30 ++++ .../cases_ignore_works_over_restrict.yaml | 98 +++++++++++ .../cases_whodata_prevails_over_realtime.yaml | 15 ++ .../data/test_cases/cases_whodata_thread.yaml | 17 ++ .../data/wazuh_conf_ignore_restrict.yaml | 53 ------ .../wazuh_conf_ignore_restrict_win32.yaml | 81 --------- ...h_conf_whodata_prevails_over_realtime.yaml | 35 ---- .../data/wazuh_conf_whodata_thread.yaml | 66 -------- .../test_ambiguous_whodata_thread.py | 105 ++++++------ .../test_ignore_works_over_restrict.py | 157 ++++++++---------- .../test_whodata_prevails_over_realtime.py | 133 ++++++++------- .../data/wazuh_conf_num_watches.yaml | 2 +- .../test_inotify/test_num_watches.py | 11 +- .../test_sync_max_eps_scheduled.py | 8 +- .../test_restrict/test_restrict_valid.py | 1 + .../test_files/test_scan/test_scan_day.py | 6 +- .../test_scan/test_scan_day_and_time.py | 6 +- .../test_files/test_scan/test_scan_time.py | 6 +- .../test_registry_ambiguous_complex.py | 23 +-- ...t_registry_ambiguous_duplicated_entries.py | 11 +- .../test_registry_ambiguous_simple.py | 7 +- .../data/wazuh_conf_reg_attr.yaml | 2 + .../test_basic_usage_delete_registry.py | 3 +- ...est_basic_usage_entries_match_key_count.py | 32 ++-- .../test_basic_usage_registry_new_key.py | 3 +- .../test_long_registry_path.py | 2 + .../test_registry_checkers.py | 6 +- .../data/wazuh_registry_ignore_conf.yaml | 4 + .../test_ignore_registry.py | 25 ++- .../test_registry_limit/data/wazuh_conf.yaml | 6 +- .../test_multiple_keys.py | 8 +- .../test_registry_no_diff.py | 2 + .../data/wazuh_registry_report_changes.yaml | 2 + .../test_registry_disk_quota_values.py | 2 + .../test_registry_diff_size_limit_values.py | 2 + .../test_registry_file_size_values.py | 2 + .../test_registry_report_changes.py | 2 + ...st_registry_report_changes_more_changes.py | 2 + .../data/wazuh_restrict_conf.yaml | 4 + .../test_registry_restrict.py | 2 + .../test_registry_tags/test_registry_tags.py | 2 + .../data/wazuh_conf_integrity_scan_win32.yaml | 2 +- .../test_registry_responses_win32.py | 2 + .../test_synchronization/test_sync_overlap.py | 3 + .../test_synchronize_integrity_win32.py | 15 +- 53 files changed, 651 insertions(+), 547 deletions(-) create mode 100644 tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_ignore_works_over_restrict.yaml create mode 100644 tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_ignore_works_over_restrict_win32.yaml create mode 100644 tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_whodata_prevails_over_realtime.yaml create mode 100644 tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_whodata_thread.yaml create mode 100644 tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_ignore_works_over_restrict.yaml create mode 100644 tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_whodata_prevails_over_realtime.yaml create mode 100644 tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_whodata_thread.yaml delete mode 100644 tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_ignore_restrict.yaml delete mode 100644 tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_ignore_restrict_win32.yaml delete mode 100644 tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_whodata_prevails_over_realtime.yaml delete mode 100644 tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_whodata_thread.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 7ce7297dcf..b5bf6da3c2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,7 +18,7 @@ All notable changes to this project will be documented in this file. - Add new module to support migration tool. ([#3837](https://github.com/wazuh/wazuh-qa/pull/3837)) ### Changed - +- Update FIM test_ambiguous_confs IT to new framework ([#4121](https://github.com/wazuh/wazuh-qa/pull/4121)) \- (Tests + Framework) - Update `test_logcollector` invalid configs log level ([#4094](https://github.com/wazuh/wazuh-qa/pull/4094)) \- (Tests) - Update `test_office365` to support the new tag `API_TYPE` ([#4065](https://github.com/wazuh/wazuh-qa/pull/4065)) \- (Framework + Tests) - Update `test_wazuh_db` & `test_enrollment` to support new column `status_code` and new value on the enrollment `payload`. ([#4021](https://github.com/wazuh/wazuh-qa/pull/4021)) \- (Tests) diff --git a/deps/wazuh_testing/wazuh_testing/modules/fim/classes.py b/deps/wazuh_testing/wazuh_testing/modules/fim/classes.py index 06b734fd6f..35edeaf4f9 100644 --- a/deps/wazuh_testing/wazuh_testing/modules/fim/classes.py +++ b/deps/wazuh_testing/wazuh_testing/modules/fim/classes.py @@ -15,8 +15,6 @@ if sys.platform == 'linux2' or sys.platform == 'linux': from jq import jq -_data_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') - def validate_event(event, checks=None, mode=None): """Check if event is properly formatted according to some checks. @@ -103,7 +101,7 @@ def get_required_attributes(check_attributes, result=None): return result json_file = 'syscheck_event_windows.json' if sys.platform == "win32" else 'syscheck_event.json' - with open(os.path.join(_data_path, json_file), 'r') as f: + with open(os.path.join(WAZUH_TESTING_DATA_PATH, json_file), 'r') as f: schema = json.load(f) validate(schema=schema, instance=event) diff --git a/deps/wazuh_testing/wazuh_testing/modules/fim/event_monitor.py b/deps/wazuh_testing/wazuh_testing/modules/fim/event_monitor.py index 4eb58724e5..131a51a14c 100644 --- a/deps/wazuh_testing/wazuh_testing/modules/fim/event_monitor.py +++ b/deps/wazuh_testing/wazuh_testing/modules/fim/event_monitor.py @@ -55,6 +55,8 @@ CB_SWITCHING_DIRECTORIES_TO_REALTIME = r'.*state_checker.*(Audit policy change detected.\ Switching directories to realtime)' CB_RECIEVED_EVENT_4719 = r'.*win_whodata.*(Event 4719).*Switching directories to realtime' +CB_FIM_REGISTRY_ENTRIES_COUNT = r".*Fim registry entries count: '(.*)'" +CB_FIM_REGISTRY_VALUES_ENTRIES_COUNT = r".*Fim registry values entries count: '(.*)'" # Error message ERR_MSG_REALTIME_FOLDERS_EVENT = 'Did not receive expected "Folders monitored with real-time engine" event' @@ -78,8 +80,7 @@ ERR_MSG_REGISTRY_LIMIT_VALUES = 'Did not receive expected "DEBUG: ...: Maximum number of registry values to \ be monitored: ..." event' ERR_MSG_WRONG_REGISTRY_LIMIT_VALUE = 'Wrong value for db_value_limit registries tag.' -ERR_MSG_FILE_LIMIT_VALUES = 'Did not receive expected "DEBUG: ...: Maximum number of entries to be monitored: \ - ..." event' +ERR_MSG_FILE_LIMIT_VALUES = 'Did not receive expected "DEBUG: ...: Maximum number of files to be monitored:..." event' ERR_MSG_WRONG_FILE_LIMIT_VALUE = 'Wrong value for file_limit.' ERR_MSG_FILE_LIMIT_DISABLED = 'Did not receive expected "DEBUG: ...: No limit set to maximum number of entries \ to be monitored" event' @@ -187,11 +188,38 @@ def callback_integrity_message(line): return datetime.strptime(match.group(1), '%Y/%m/%d %H:%M:%S'), json.dumps(match.group(2)) +def callback_integrity_sync_message(line): + """ Callback that detects if a line contains a integrity sync event + Args: + line (String): string line to be checked by callback in FileMonitor. + Returns: + List: returns a list with formated datetime, And the event's JSON data. + """ + if callback_detect_integrity_control_event(line): + match = re.match(r"(\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}).*({.*?})$", line) + if match: + return datetime.strptime(match.group(1), '%Y/%m/%d %H:%M:%S'), json.dumps(match.group(2)) + + +def callback_detect_integrity_check_global(line): + """ Callback that detects if a line contains an 'integrity_check_global' event + Args: + line (String): string line to be checked by callback in FileMonitor. + Returns: + JSON: returns event's JSON data. + """ + match = callback_detect_integrity_control_event(line) + if match: + if match['type'] == 'integrity_check_global': + return match + return None + + def callback_detect_file_integrity_event(line): """ Callback that detects if a line contains a file integrity event Args: - line (String): string line to be checked by callback in File_Monitor. + line (String): string line to be checked by callback in FileMonitor. """ event = callback_detect_integrity_control_event(line) if event and event['component'] == 'fim_file': @@ -212,7 +240,7 @@ def callback_detect_registry_integrity_event(line): """ Callback that detects if a line contains a registry integrity event for a registry_key or registry_value Args: - line (String): string line to be checked by callback in File_Monitor. + line (String): string line to be checked by callback in FileMonitor. """ event = callback_detect_integrity_control_event(line) if event and event['component'] == 'fim_registry_key': @@ -226,7 +254,7 @@ def callback_detect_registry_integrity_state_event(line): """ Callback that detects if a line contains a registry integrity event of the state type Args: - line (String): string line to be checked by callback in File_Monitor. + line (String): string line to be checked by callback in FileMonitor. """ event = callback_detect_registry_integrity_event(line) if event and event['type'] == 'state': @@ -251,7 +279,7 @@ def callback_num_inotify_watches(line): """ Callback that detects if a line contains the folders monitored in realtime event Args: - line (String): string line to be checked by callback in File_Monitor. + line (String): string line to be checked by callback in FileMonitor. """ match = re.match(CB_FOLDERS_MONITORED_REALTIME, line) @@ -276,17 +304,20 @@ def callback_state_event_time(line): def callback_real_time_whodata_started(line): """ Callback that detects if a line contains "Whodata engine started" event Args: - line (String): string line to be checked by callback in File_Monitor. + line (String): string line to be checked by callback in FileMonitor. """ - if CB_REALTIME_WHODATA_ENGINE_STARTED in line: + match = re.match(CB_REALTIME_WHODATA_ENGINE_STARTED, line) + if match: return True + return None + def callback_detect_registry_integrity_clear_event(line): """ Callback that detects if a line contains a registry integrity_clear event Args: - line (String): string line to be checked by callback in File_Monitor. + line (String): string line to be checked by callback in FileMonitor. """ event = callback_detect_integrity_control_event(line) if event and event['component'] == 'fim_registry_key' and event['type'] == 'integrity_clear': @@ -434,13 +465,14 @@ def detect_realtime_start(file_monitor): error_message=ERR_MSG_FOLDERS_MONITORED_REALTIME) -def detect_whodata_start(file_monitor): +def detect_whodata_start(file_monitor, timeout=T_60): """Detect whodata engine start when restarting Wazuh. Args: file_monitor (FileMonitor): file log monitor to detect events + timeout (int): timeout for file monitor to try to detect event """ - file_monitor.start(timeout=T_60, callback=generate_monitoring_callback(CB_REALTIME_WHODATA_ENGINE_STARTED), + file_monitor.start(timeout=timeout, callback=generate_monitoring_callback(CB_REALTIME_WHODATA_ENGINE_STARTED), error_message=ERR_MSG_WHODATA_ENGINE_EVENT) diff --git a/deps/wazuh_testing/wazuh_testing/modules/fim/utils.py b/deps/wazuh_testing/wazuh_testing/modules/fim/utils.py index 47b9a5e34d..149e729e68 100644 --- a/deps/wazuh_testing/wazuh_testing/modules/fim/utils.py +++ b/deps/wazuh_testing/wazuh_testing/modules/fim/utils.py @@ -17,12 +17,14 @@ from wazuh_testing.tools.time import TimeMachine from wazuh_testing.modules import fim from wazuh_testing.modules.fim import event_monitor as ev -from wazuh_testing.modules.fim.classes import CustomValidator, EventChecker +from wazuh_testing.modules.fim.classes import CustomValidator, EventChecker, RegistryEventChecker if sys.platform == 'win32': import win32con import win32api + import win32security as win32sec + import ntsecuritycon as ntc import pywintypes @@ -101,15 +103,14 @@ def create_registry(key, subkey, arch): if sys.platform == 'win32': try: - logger.info("Creating registry key " + str(os.path.join(fim.registry_class_name[key], subkey))) - key = win32api.RegCreateKeyEx(key, subkey, win32con.KEY_ALL_ACCESS | arch) - + logger.info("Created registry key " + str(os.path.join(fim.registry_class_name[key], subkey))) return key[0] # Ignore the flag that RegCreateKeyEx returns except OSError as e: logger.warning(f"Registry could not be created: {e}") except pywintypes.error as e: logger.warning(f"Registry could not be created: {e}") + def modify_key_perms(key, subkey, arch, user): diff --git a/tests/integration/test_fim/conftest.py b/tests/integration/test_fim/conftest.py index 16a8f4c36d..943f467877 100644 --- a/tests/integration/test_fim/conftest.py +++ b/tests/integration/test_fim/conftest.py @@ -136,12 +136,14 @@ def create_monitored_folders(test_folders): test_folders(list): List of folders to create and delete """ for folder in test_folders: - os.mkdir(folder, mode=0o0777) + if not os.path.exists(folder): + os.mkdir(folder, mode=0o0777) yield for folder in test_folders: - delete_path_recursively(folder) + if os.path.exists(folder): + delete_path_recursively(folder) @pytest.fixture(scope='module') @@ -153,12 +155,14 @@ def create_monitored_folders_module(test_folders): test_folders(list): List of folders to create and delete """ for folder in test_folders: - os.mkdir(folder, mode=0o0777) + if not os.path.exists(folder): + os.mkdir(folder, mode=0o0777) yield for folder in test_folders: - delete_path_recursively(folder) + if os.path.exists(folder): + delete_path_recursively(folder) @pytest.fixture() diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_ignore_works_over_restrict.yaml b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_ignore_works_over_restrict.yaml new file mode 100644 index 0000000000..038a79748b --- /dev/null +++ b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_ignore_works_over_restrict.yaml @@ -0,0 +1,42 @@ +- sections: + - section: syscheck + elements: + - disabled: + value: 'no' + - frequency: + value: 3 + - directories: + value: TEST_DIR1 + attributes: + - restrict: testfile$ + - whodata: WHODATA + - realtime: REALTIME + - directories: + value: TEST_DIR2 + attributes: + - restrict: regex_testfile$ + - whodata: WHODATA + - realtime: REALTIME + - ignore: + value: /testdir1/testfile + - ignore: + value: regex_testfile$ + attributes: + - type: sregex + + - section: sca + elements: + - enabled: + value: 'no' + + - section: rootcheck + elements: + - disabled: + value: 'yes' + + - section: wodle + attributes: + - name: syscollector + elements: + - disabled: + value: 'yes' diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_ignore_works_over_restrict_win32.yaml b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_ignore_works_over_restrict_win32.yaml new file mode 100644 index 0000000000..d216632f00 --- /dev/null +++ b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_ignore_works_over_restrict_win32.yaml @@ -0,0 +1,42 @@ +- sections: + - section: syscheck + elements: + - disabled: + value: 'no' + - frequency: + value: 3 + - directories: + value: TEST_DIR1 + attributes: + - restrict: testfile$ + - whodata: WHODATA + - realtime: REALTIME + - directories: + value: TEST_DIR2 + attributes: + - restrict: regex_testfile$ + - whodata: WHODATA + - realtime: REALTIME + - ignore: + value: c:\\testdir1\\testfile + - ignore: + value: regex_testfile$ + attributes: + - type: sregex + + - section: sca + elements: + - enabled: + value: 'no' + + - section: rootcheck + elements: + - disabled: + value: 'yes' + + - section: wodle + attributes: + - name: syscollector + elements: + - disabled: + value: 'yes' diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_whodata_prevails_over_realtime.yaml b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_whodata_prevails_over_realtime.yaml new file mode 100644 index 0000000000..cd311d79da --- /dev/null +++ b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_whodata_prevails_over_realtime.yaml @@ -0,0 +1,27 @@ +- sections: + - section: syscheck + elements: + - disabled: + value: 'no' + - directories: + value: TEST_DIR + attributes: + - whodata: WHODATA + - realtime: REALTIME + + - section: sca + elements: + - enabled: + value: 'no' + + - section: rootcheck + elements: + - disabled: + value: 'yes' + + - section: wodle + attributes: + - name: syscollector + elements: + - disabled: + value: 'yes' diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_whodata_thread.yaml b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_whodata_thread.yaml new file mode 100644 index 0000000000..6687449f2c --- /dev/null +++ b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/configuration_templates/configuration_whodata_thread.yaml @@ -0,0 +1,30 @@ +- sections: + - section: syscheck + elements: + - disabled: + value: 'no' + - directories: + value: TEST_DIR1 + attributes: + - whodata: WHODATA1 + - directories: + value: TEST_DIR2 + attributes: + - whodata: WHODATA2 + + - section: sca + elements: + - enabled: + value: 'no' + + - section: rootcheck + elements: + - disabled: + value: 'yes' + + - section: wodle + attributes: + - name: syscollector + elements: + - disabled: + value: 'yes' diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_ignore_works_over_restrict.yaml b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_ignore_works_over_restrict.yaml new file mode 100644 index 0000000000..05c566be34 --- /dev/null +++ b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_ignore_works_over_restrict.yaml @@ -0,0 +1,98 @@ +- name: ignore_file_pattern_over_restrict_regex_scheduled + description: Check ignore pattern is applied over restrict regex + configuration_parameters: + REALTIME: 'no' + WHODATA: 'no' + metadata: + folder_index: 0 + filename: testfile + is_pattern: true + fim_mode: scheduled + +- name: ignore_file_pattern_over_restrict_regex_realtime + description: Check ignore pattern is applied over restrict regex + configuration_parameters: + REALTIME: 'yes' + WHODATA: 'no' + metadata: + folder_index: 0 + filename: testfile + is_pattern: true + fim_mode: realtime + +- name: ignore_file_pattern_over_restrict_regex_whodata + description: Check ignore pattern is applied over restrict regex + configuration_parameters: + REALTIME: 'no' + WHODATA: 'yes' + metadata: + folder_index: 0 + filename: testfile + is_pattern: true + fim_mode: whodata + +- name: ignore_sregex_over_restrict_regex_different_regex_scheduled + description: Check ignore with sregex is applied over restrict regex - Regexes are different + configuration_parameters: + REALTIME: 'no' + WHODATA: 'no' + metadata: + folder_index: 0 + filename: regex_testfile + is_pattern: false + fim_mode: scheduled + +- name: ignore_sregex_over_restrict_regex_different_regex_realtime + description: Check ignore with sregex is applied over restrict regex - Regexes are different + configuration_parameters: + REALTIME: 'yes' + WHODATA: 'no' + metadata: + folder_index: 0 + filename: regex_testfile + is_pattern: false + fim_mode: realtime + +- name: ignore_sregex_over_restrict_regex_different_regex_whodata + description: Check ignore with sregex is applied over restrict regex - Regexes are different + configuration_parameters: + REALTIME: 'no' + WHODATA: 'yes' + metadata: + folder_index: 0 + filename: regex_testfile + is_pattern: false + fim_mode: whodata + +- name: ignore_sregex_over_restrict_regex_same_regex_scheduled + description: Check ignore with sregex is applied over restrict regex - Regexes are the same + configuration_parameters: + REALTIME: 'no' + WHODATA: 'no' + metadata: + folder_index: 1 + filename: regex_testfile + is_pattern: false + fim_mode: scheduled + +- name: ignore_sregex_over_restrict_regex_same_regex_realtime + description: Check ignore with sregex is applied over restrict regex - Regexes are the same + configuration_parameters: + REALTIME: 'yes' + WHODATA: 'no' + metadata: + folder_index: 1 + filename: regex_testfile + is_pattern: false + fim_mode: realtime + +- name: ignore_sregex_over_restrict_regex_same_regex_whodata + description: Check ignore with sregex is applied over restrict regex - Regexes are the same + configuration_parameters: + REALTIME: 'no' + WHODATA: 'yes' + metadata: + folder_index: 1 + filename: regex_testfile + is_pattern: false + fim_mode: whodata diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_whodata_prevails_over_realtime.yaml b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_whodata_prevails_over_realtime.yaml new file mode 100644 index 0000000000..107c5d10d8 --- /dev/null +++ b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_whodata_prevails_over_realtime.yaml @@ -0,0 +1,15 @@ +- name: whodata_thread_started_with_realtime_enabled + description: Check Whodata thread is enabled and is used with realtime enabled on same tag + configuration_parameters: + WHODATA: 'yes' + REALTIME: 'yes' + metadata: + fim_mode: whodata + +- name: whodata_thread_started_with_realtime_disabled + description: Check Whodata thread is enabled and is used with realtime disabled on same tag + configuration_parameters: + WHODATA: 'yes' + REALTIME: 'no' + metadata: + fim_mode: whodata diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_whodata_thread.yaml b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_whodata_thread.yaml new file mode 100644 index 0000000000..1aebbc0c06 --- /dev/null +++ b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/test_cases/cases_whodata_thread.yaml @@ -0,0 +1,17 @@ +- name: whodata_thread_disabled + description: Check Whodata thread is disabled when last directory has it set to 'no' + configuration_parameters: + WHODATA1: 'yes' + WHODATA2: 'no' + metadata: + fim_mode: whodata + whodata_enabled: false + +- name: whodata_thread_enabled + description: Check Whodata thread is enabled when last directory has it set to 'yes' + configuration_parameters: + WHODATA1: 'no' + WHODATA2: 'yes' + metadata: + fim_mode: whodata + whodata_enabled: true diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_ignore_restrict.yaml b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_ignore_restrict.yaml deleted file mode 100644 index 1f503cdc38..0000000000 --- a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_ignore_restrict.yaml +++ /dev/null @@ -1,53 +0,0 @@ -# Conf 1 -- tags: - - valid_no_regex - apply_to_modules: - - test_ignore_works_over_restrict - sections: - - section: syscheck - elements: - - disabled: - value: "no" - - frequency: - value: 1 - - directories: - value: /testdir1 - attributes: - - check_all: "yes" - - restrict: testfile$ - - FIM_MODE - - directories: - value: /testdir2 - attributes: - - check_all: "yes" - - FIM_MODE - - ignore: - value: /testdir1/testfile -# Conf 2 -- tags: - - valid_regex - apply_to_modules: - - test_ignore_works_over_restrict - sections: - - section: syscheck - elements: - - disabled: - value: "no" - - frequency: - value: 1 - - directories: - value: /testdir1 - attributes: - - check_all: "yes" - - restrict: testfile2$ - - FIM_MODE - - directories: - value: /testdir2 - attributes: - - check_all: "yes" - - restrict: not_ignored_sregex$ - - FIM_MODE - - ignore: - value: testfile2$ - attributes: - - type: sregex diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_ignore_restrict_win32.yaml b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_ignore_restrict_win32.yaml deleted file mode 100644 index 1bbf7316a6..0000000000 --- a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_ignore_restrict_win32.yaml +++ /dev/null @@ -1,81 +0,0 @@ -# Conf 1 -- tags: - - valid_no_regex - apply_to_modules: - - test_ignore_works_over_restrict - sections: - - section: syscheck - elements: - - disabled: - value: "no" - - frequency: - value: 1 - - directories: - value: c:\\testdir1 - attributes: - - check_all: "yes" - - restrict: testfile$ - - FIM_MODE - - directories: - value: c:\\testdir2 - attributes: - - check_all: "yes" - - FIM_MODE - - ignore: - value: c:\\testdir1\\testfile - - section: sca - elements: - - enabled: - value: "no" - - section: rootcheck - elements: - - disabled: - value: "yes" - - section: wodle - attributes: - - name: syscollector - elements: - - disabled: - value: "yes" -# Conf 2 -- tags: - - valid_regex - apply_to_modules: - - test_ignore_works_over_restrict - sections: - - section: syscheck - elements: - - disabled: - value: "no" - - frequency: - value: 1 - - directories: - value: c:\\testdir1 - attributes: - - check_all: "yes" - - restrict: testfile2$ - - FIM_MODE - - directories: - value: c:\\testdir2 - attributes: - - check_all: "yes" - - restrict: not_ignored_sregex$ - - FIM_MODE - - ignore: - value: testfile2$ - attributes: - - type: sregex - - section: sca - elements: - - enabled: - value: "no" - - section: rootcheck - elements: - - disabled: - value: "yes" - - section: wodle - attributes: - - name: syscollector - elements: - - disabled: - value: "yes" diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_whodata_prevails_over_realtime.yaml b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_whodata_prevails_over_realtime.yaml deleted file mode 100644 index 26ff1fcb7e..0000000000 --- a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_whodata_prevails_over_realtime.yaml +++ /dev/null @@ -1,35 +0,0 @@ -# conf 1 -- tags: - - ossec_conf - apply_to_modules: - - MODULE_NAME - sections: - - section: syscheck - elements: - - disabled: - value: 'no' - - directories: - value: TEST_DIR1 - attributes: - - realtime: 'yes' - - whodata: 'yes' - - directories: - value: TEST_DIR2 - attributes: - - whodata: 'yes' - - realtime: 'yes' - - section: sca - elements: - - enabled: - value: 'no' - - section: rootcheck - elements: - - disabled: - value: 'yes' - - section: wodle - attributes: - - name: 'syscollector' - elements: - - disabled: - value: 'yes' - diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_whodata_thread.yaml b/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_whodata_thread.yaml deleted file mode 100644 index f24ee10ee0..0000000000 --- a/tests/integration/test_fim/test_files/test_ambiguous_confs/data/wazuh_conf_whodata_thread.yaml +++ /dev/null @@ -1,66 +0,0 @@ ---- -# conf 1 -- tags: - - whodata_disabled_conf - apply_to_modules: - - test_ambiguous_whodata_thread - sections: - - section: syscheck - elements: - - disabled: - value: 'no' - - directories: - value: TEST_DIRECTORIES - attributes: - - whodata: 'yes' - - directories: - value: TEST_DIRECTORIES - attributes: - - whodata: 'no' - - section: sca - elements: - - enabled: - value: 'no' - - section: rootcheck - elements: - - disabled: - value: 'yes' - - section: wodle - attributes: - - name: 'syscollector' - elements: - - disabled: - value: 'yes' - -# conf 2 -- tags: - - whodata_enabled_conf - apply_to_modules: - - test_ambiguous_whodata_thread - sections: - - section: syscheck - elements: - - disabled: - value: 'no' - - directories: - value: TEST_DIRECTORIES - attributes: - - whodata: 'no' - - directories: - value: TEST_DIRECTORIES - attributes: - - whodata: 'yes' - - section: sca - elements: - - enabled: - value: 'no' - - section: rootcheck - elements: - - disabled: - value: 'yes' - - section: wodle - attributes: - - name: 'syscollector' - elements: - - disabled: - value: 'yes' diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/test_ambiguous_whodata_thread.py b/tests/integration/test_fim/test_files/test_ambiguous_confs/test_ambiguous_whodata_thread.py index 52f27a3729..c0b27504a1 100644 --- a/tests/integration/test_fim/test_files/test_ambiguous_confs/test_ambiguous_whodata_thread.py +++ b/tests/integration/test_fim/test_files/test_ambiguous_confs/test_ambiguous_whodata_thread.py @@ -1,5 +1,5 @@ ''' -copyright: Copyright (C) 2015-2022, Wazuh Inc. +copyright: Copyright (C) 2015-2023, Wazuh Inc. Created by Wazuh, Inc. . @@ -62,78 +62,80 @@ import os import pytest -from wazuh_testing import global_parameters -from wazuh_testing.fim import LOG_FILE_PATH, generate_params, callback_real_time_whodata_started -from wazuh_testing.tools import PREFIX -from wazuh_testing.tools.configuration import load_wazuh_configurations, check_apply_test +from wazuh_testing import LOG_FILE_PATH, T_30 +from wazuh_testing.tools import configuration, PREFIX from wazuh_testing.tools.monitoring import FileMonitor - -# Marks +from wazuh_testing.modules.fim.event_monitor import detect_whodata_start +from wazuh_testing.modules.fim import FIM_DEFAULT_LOCAL_INTERNAL_OPTIONS as local_internal_options -pytestmark = [pytest.mark.linux, pytest.mark.tier(level=2)] +# Marks +pytestmark = [pytest.mark.linux, pytest.mark.win32, pytest.mark.tier(level=2)] # Variables -test_directories = [os.path.join(PREFIX, 'testdir1')] - -directory_str = ','.join(test_directories) -wazuh_log_monitor = FileMonitor(LOG_FILE_PATH) -test_data_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') -configurations_path = os.path.join(test_data_path, 'wazuh_conf_whodata_thread.yaml') -testdir1 = test_directories[0] +test_directories = os.path.join(PREFIX, 'testidr1') # Configurations +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, 'configuration_templates') +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, 'test_cases') -p, m = generate_params(extra_params={"TEST_DIRECTORIES": testdir1}, modes=['whodata']) - -configurations = load_wazuh_configurations(configurations_path, __name__, params=p, metadata=m) - +# Configuration and cases data +test_cases_path = os.path.join(TEST_CASES_PATH, 'cases_whodata_thread.yaml') +configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_whodata_thread.yaml') -# Fixtures - - -@pytest.fixture(scope='module', params=configurations) -def get_configuration(request): - """Get configurations from the module.""" - return request.param +# Test configurations +configuration_parameters, configuration_metadata, test_case_ids = configuration.get_test_cases_data(test_cases_path) +for count, value in enumerate(configuration_parameters): + configuration_parameters[count]['TEST_DIR1'] = test_directories + configuration_parameters[count]['TEST_DIR2'] = test_directories +configurations = configuration.load_configuration_template(configurations_path, configuration_parameters, + configuration_metadata) # Tests - - -@pytest.mark.parametrize('whodata_enabled, tags_to_apply', [ - (False, {'whodata_disabled_conf'}), - (True, {'whodata_enabled_conf'}) -]) -def test_ambiguous_whodata_thread(whodata_enabled, tags_to_apply, get_configuration, configure_environment, - restart_syscheckd): +@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=test_case_ids) +def test_ambiguous_whodata_thread(configuration, metadata, set_wazuh_configuration, + configure_local_internal_options_function, restart_syscheck_function): ''' description: Check if the 'wazuh-syscheckd' daemon starts the 'whodata' thread when the configuration is ambiguous. For example, when using 'whodata' on the same directory using conflicting values ('yes' and 'no'). For this purpose, the configuration is applied and it checks that the last value detected for 'whodata' in the 'ossec.conf' file is the one used. + test_phases: + - setup: + - Set wazuh configuration and local_internal_options. + - Create custom folder for monitoring + - Clean logs files and restart wazuh to apply the configuration. + - test: + - Detect if real-time whodata thread has been started + - teardown: + - Delete custom monitored folder + - Restore configuration + - Stop wazuh + wazuh_min_version: 4.2.0 tier: 2 parameters: - - whodata_enabled: - type: bool - brief: Who-data status. - - tags_to_apply: - type: set - brief: Run test if match with a configuration identifier, skip otherwise. - - get_configuration: + - configuration: + type: dict + brief: Configuration values for ossec.conf. + - metadata: + type: dict + brief: Test case data. + - set_wazuh_configuration: type: fixture - brief: Get configurations from the module. - - configure_environment: + brief: Set ossec.conf configuration. + - configure_local_internal_options_function: type: fixture - brief: Configure a custom environment for testing. - - restart_syscheckd: + brief: Set local_internal_options.conf file. + - restart_syscheck_function: type: fixture - brief: Clear the 'ossec.log' file and start a new monitor. + brief: restart syscheckd daemon, and truncate the ossec.log. assertions: - Verify that 'whodata' thread is started when the last 'whodata' value detected is set to 'yes'. @@ -149,14 +151,11 @@ def test_ambiguous_whodata_thread(whodata_enabled, tags_to_apply, get_configurat tags: - who_data ''' - check_apply_test(tags_to_apply, get_configuration['tags']) + wazuh_log_monitor = FileMonitor(LOG_FILE_PATH) - if whodata_enabled: - wazuh_log_monitor.start(timeout=global_parameters.default_timeout, callback=callback_real_time_whodata_started, - error_message='Did not receive expected ' - '"File integrity monitoring real-time Whodata engine started" event') + if metadata['whodata_enabled']: + detect_whodata_start(wazuh_log_monitor, timeout=T_30) else: with pytest.raises(TimeoutError): - wazuh_log_monitor.start(timeout=global_parameters.default_timeout, - callback=callback_real_time_whodata_started) + detect_whodata_start(wazuh_log_monitor, timeout=T_30) raise AttributeError(f'Unexpected event "File integrity monitoring real-time Whodata engine started"') diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/test_ignore_works_over_restrict.py b/tests/integration/test_fim/test_files/test_ambiguous_confs/test_ignore_works_over_restrict.py index 841ccf842c..74e22b2eac 100644 --- a/tests/integration/test_fim/test_files/test_ambiguous_confs/test_ignore_works_over_restrict.py +++ b/tests/integration/test_fim/test_files/test_ambiguous_confs/test_ignore_works_over_restrict.py @@ -1,5 +1,5 @@ ''' -copyright: Copyright (C) 2015-2022, Wazuh Inc. +copyright: Copyright (C) 2015-2023, Wazuh Inc. Created by Wazuh, Inc. . @@ -64,53 +64,45 @@ import sys import pytest -from wazuh_testing import logger -from wazuh_testing.fim import LOG_FILE_PATH, callback_detect_event, create_file, REGULAR, generate_params -from wazuh_testing.modules.fim.event_monitor import CB_IGNORING_DUE_TO_SREGEX, CB_IGNORING_DUE_TO_PATTERN +from wazuh_testing import LOG_FILE_PATH, REGULAR, T_10 from wazuh_testing.tools import PREFIX -from wazuh_testing.tools.configuration import load_wazuh_configurations, check_apply_test +from wazuh_testing.modules.fim.event_monitor import CB_IGNORING_DUE_TO_SREGEX, CB_IGNORING_DUE_TO_PATTERN +from wazuh_testing.tools.configuration import get_test_cases_data, load_configuration_template +from wazuh_testing.tools.file import create_file from wazuh_testing.tools.monitoring import FileMonitor, generate_monitoring_callback +from wazuh_testing.modules.fim import FIM_DEFAULT_LOCAL_INTERNAL_OPTIONS as local_internal_options # Marks - -pytestmark = pytest.mark.tier(level=2) +pytestmark = [pytest.mark.linux, pytest.mark.win32, pytest.mark.tier(level=2)] # Variables - -test_data_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') -conf_path = os.path.join(test_data_path, - 'wazuh_conf_ignore_restrict_win32.yaml'if sys.platform == 'win32' - else 'wazuh_conf_ignore_restrict.yaml') test_directories = [os.path.join(PREFIX, 'testdir1'), os.path.join(PREFIX, 'testdir2')] -testdir1, testdir2 = test_directories - -wazuh_log_monitor = FileMonitor(LOG_FILE_PATH) # Configurations +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, 'configuration_templates') +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, 'test_cases') -params, metadata = generate_params() -configurations = load_wazuh_configurations(conf_path, __name__, params=params, metadata=metadata) - -# Fixtures +# Configuration and cases data +test_cases_path = os.path.join(TEST_CASES_PATH, 'cases_ignore_works_over_restrict.yaml') +config_file = 'configuration_ignore_works_over_restrict_win32.yaml' if sys.platform == 'win32' else \ + 'configuration_ignore_works_over_restrict.yaml' +configurations_path = os.path.join(CONFIGURATIONS_PATH, config_file) +# Test configurations +configuration_parameters, configuration_metadata, test_case_ids = get_test_cases_data(test_cases_path) +for count, value in enumerate(configuration_parameters): + configuration_parameters[count]['TEST_DIR1'] = test_directories[0] + configuration_parameters[count]['TEST_DIR2'] = test_directories[1] +configurations = load_configuration_template(configurations_path, configuration_parameters, configuration_metadata) -@pytest.fixture(scope='module', params=configurations) -def get_configuration(request): - """Get configurations from the module.""" - return request.param # Tests - - -@pytest.mark.parametrize('folder, filename, triggers_event, tags_to_apply', [ - (testdir1, 'testfile', False, {'valid_no_regex'}), - (testdir2, 'not_ignored_string', True, {'valid_no_regex'}), - (testdir1, 'testfile2', False, {'valid_regex'}), - (testdir1, 'ignore_testfile2', False, {'valid_regex'}), - (testdir2, 'not_ignored_sregex', True, {'valid_regex'}) -]) -def test_ignore_works_over_restrict(folder, filename, triggers_event, tags_to_apply, get_configuration, - configure_environment, restart_syscheckd, wait_for_fim_start): +@pytest.mark.parametrize('test_folders', [test_directories], ids='') +@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=test_case_ids) +def test_ignore_works_over_restrict(configuration, metadata, set_wazuh_configuration, test_folders, + create_monitored_folders, configure_local_internal_options_function, + restart_syscheck_function, wait_syscheck_start): ''' description: Check if the 'ignore' tag prevails over the 'restrict' one when using both in the same directory. For example, when a directory is ignored and at the same time monitoring is restricted to a file @@ -118,78 +110,75 @@ def test_ignore_works_over_restrict(folder, filename, triggers_event, tags_to_ap For this purpose, the test case configuration is applied, and it is checked if FIM events are generated when required. + test_phases: + - setup: + - Set wazuh configuration and local_internal_options. + - Create custom folder for monitoring + - Clean logs files and restart wazuh to apply the configuration. + - test: + - Create file and detect event creation event + - Validate ignored event is generated with matching regex + - teardown: + - Delete custom monitored folder + - Restore configuration + - Stop Wazuh + wazuh_min_version: 4.2.0 tier: 2 parameters: - - folder: - type: str - brief: Directory where the file is being created. - - filename: - type: str - brief: Name of the file to be created. - - triggers_event: - type: bool - brief: True if an event must be generated, False otherwise. - - tags_to_apply: - type: set - brief: Run test if match with a configuration identifier, skip otherwise. - - get_configuration: + - configuration: + type: dict + brief: Configuration values for ossec.conf. + - metadata: + type: dict + brief: Test case data. + - test_folders: + type: dict + brief: List of folders to be created for monitoring. + - set_wazuh_configuration: type: fixture - brief: Get configurations from the module. - - configure_environment: + brief: Set ossec.conf configuration. + - create_monitored_folders_module: type: fixture - brief: Configure a custom environment for testing. - - restart_syscheckd: + brief: Create a given list of folders when the module starts. Delete the folders at the end of the module. + - configure_local_internal_options_function: type: fixture - brief: Clear the 'ossec.log' file and start a new monitor. - - wait_for_fim_start: + brief: Set local_internal_options.conf file. + - restart_syscheck_function: type: fixture - brief: Wait for realtime start, whodata start, or end of initial FIM scan. + brief: restart syscheckd daemon, and truncate the ossec.log. + - wait_syscheck_start: + type: fixture + brief: check that the starting FIM scan is detected. assertions: - Verify that when a directory is ignored, the 'restrict' attribute is not taken into account to generate FIM events. - input_description: Two test cases are contained in external YAML file - (wazuh_conf_ignore_restrict.yaml or wazuh_conf_ignore_restrict_win32.yaml) - which includes configuration settings for the 'wazuh-syscheckd' daemon - and testing directories to monitor. + input_description: The file 'configuration_works_over_restrict.yaml' provides the configuration + template. + The file 'cases_ignore_works_over_restrict.yaml' provides the tes cases configuration + details for each test case. expected_output: - - r'.*Sending FIM event: (.+)$' (When the FIM event should be generated) - r".*Ignoring '.*?' '(.*?)' due to (sregex|pattern)? '.*?'" (When the FIM event should be ignored) tags: - scheduled ''' - logger.info('Applying the test configuration') - check_apply_test(tags_to_apply, get_configuration['tags']) + wazuh_log_monitor = FileMonitor(LOG_FILE_PATH) + folder = test_directories[metadata['folder_index']] + filename = metadata['filename'] # Create file that must be ignored - logger.info(f'Adding file {os.path.join(testdir1, filename)}, content: ""') create_file(REGULAR, folder, filename, content='') - # Waiting time for the new scan to be generated. - timeout = 5 # seconds - logger.info(f'Waiting up to {timeout} seconds for the new scan to be detected.') - - if triggers_event: - event = wazuh_log_monitor.start(timeout=timeout, - callback=callback_detect_event, - error_message=f'Did not receive expected "Sending FIM event" ' - f'event for file {os.path.join(testdir1, filename)}').result() - - assert event['data']['type'] == 'added', 'Event type not equal' - assert event['data']['path'] == os.path.join(folder, filename), 'Event path not equal' - else: - regex = CB_IGNORING_DUE_TO_PATTERN if 'valid_no_regex' in tags_to_apply else CB_IGNORING_DUE_TO_SREGEX - matching_log = wazuh_log_monitor.start(timeout=timeout, - accum_results=2, - callback=generate_monitoring_callback(regex), - error_message=f'Did not receive expected ' - f'"Ignoring ... due to ..." event for file ' - f'{os.path.join(testdir1, filename)}').result() - - assert os.path.join(folder, filename) in matching_log, "Ignored file log is not generated." + regex = CB_IGNORING_DUE_TO_PATTERN if metadata['is_pattern'] else CB_IGNORING_DUE_TO_SREGEX + matching_log = wazuh_log_monitor.start(timeout=T_10, accum_results=2, callback=generate_monitoring_callback(regex), + error_message=f'Did not receive expected ' + f'"Ignoring ... due to ..." event for file ' + f'{os.path.join(folder, filename)}').result() + + assert os.path.join(folder, filename) in matching_log, "Ignored file log is not generated." diff --git a/tests/integration/test_fim/test_files/test_ambiguous_confs/test_whodata_prevails_over_realtime.py b/tests/integration/test_fim/test_files/test_ambiguous_confs/test_whodata_prevails_over_realtime.py index 2a5148c66c..f780717a15 100644 --- a/tests/integration/test_fim/test_files/test_ambiguous_confs/test_whodata_prevails_over_realtime.py +++ b/tests/integration/test_fim/test_files/test_ambiguous_confs/test_whodata_prevails_over_realtime.py @@ -1,5 +1,5 @@ ''' -copyright: Copyright (C) 2015-2022, Wazuh Inc. +copyright: Copyright (C) 2015-2023, Wazuh Inc. Created by Wazuh, Inc. . @@ -59,47 +59,43 @@ import os import pytest -from wazuh_testing import global_parameters -from wazuh_testing.fim import (LOG_FILE_PATH, generate_params, callback_detect_event, - REGULAR, create_file, delete_file) +from wazuh_testing import global_parameters, LOG_FILE_PATH, REGULAR from wazuh_testing.tools import PREFIX -from wazuh_testing.tools.configuration import load_wazuh_configurations +from wazuh_testing.tools.configuration import get_test_cases_data, load_configuration_template +from wazuh_testing.tools.file import create_file, delete_file from wazuh_testing.tools.monitoring import FileMonitor +from wazuh_testing.modules.fim.event_monitor import callback_detect_event +from wazuh_testing.modules.fim import FIM_DEFAULT_LOCAL_INTERNAL_OPTIONS as local_internal_options -# Marks -pytestmark = pytest.mark.tier(level=2) - -# Variables and configuration -wazuh_log_monitor = FileMonitor(LOG_FILE_PATH) - -test_directories = [os.path.join(PREFIX, 'testdir1'), - os.path.join(PREFIX, 'testdir2') - ] -dir1, dir2 = test_directories -test_data_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') -configurations_path = os.path.join(test_data_path, 'wazuh_conf_whodata_prevails_over_realtime.yaml') +# Marks +pytestmark = [pytest.mark.linux, pytest.mark.win32, pytest.mark.tier(level=2)] -conf_params = {'TEST_DIR1': dir1, 'TEST_DIR2': dir2, 'MODULE_NAME': __name__} -p, m = generate_params(extra_params=conf_params, modes=['whodata']) +# Variables +test_directories = [os.path.join(PREFIX, 'testdir1')] -configurations = load_wazuh_configurations(configurations_path, __name__, params=p, metadata=m) +# Configuration paths +TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') +CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, 'configuration_templates') +TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, 'test_cases') +# Configuration and cases data +test_cases_path = os.path.join(TEST_CASES_PATH, 'cases_whodata_prevails_over_realtime.yaml') +configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_whodata_prevails_over_realtime.yaml') -# Fixture -@pytest.fixture(scope='module', params=configurations) -def get_configuration(request): - """Get configurations from the module.""" - return request.param +# Test configurations +configuration_parameters, configuration_metadata, test_case_ids = get_test_cases_data(test_cases_path) +for count, value in enumerate(configuration_parameters): + configuration_parameters[count]['TEST_DIR'] = test_directories[0] +configurations = load_configuration_template(configurations_path, configuration_parameters, configuration_metadata) # Test -@pytest.mark.parametrize('directory', [ - dir1, - dir2, -]) -def test_whodata_prevails_over_realtime(directory, get_configuration, put_env_variables, configure_environment, - restart_syscheckd, wait_for_fim_start): +@pytest.mark.parametrize('test_folders', [test_directories], scope="module", ids='') +@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=test_case_ids) +def test_whodata_prevails_over_realtime(configuration, metadata, set_wazuh_configuration, test_folders, + create_monitored_folders_module, configure_local_internal_options_function, + restart_syscheck_function, wait_syscheck_start): ''' description: Check if when using the options who-data and real-time at the same time the value of 'whodata' is the one used. For example, when using 'whodata=yes' @@ -109,59 +105,80 @@ def test_whodata_prevails_over_realtime(directory, get_configuration, put_env_va 'who-data' is set to 'yes', the 'realtime' value is not taken into account, enabling in this case the real-time file monitoring. + test_phases: + - setup: + - Set wazuh configuration and local_internal_options. + - Create custom folder for monitoring + - Clean logs files and restart wazuh to apply the configuration. + - test: + - Create file and detect event creation event + - Validate mode is whodata + - Delete file and detect event deletion event + - Validate mode is whodata + - teardown: + - Delete custom monitored folder + - Restore configuration + - Stop wazuh + wazuh_min_version: 4.2.0 tier: 2 parameters: - - directory: - type: str - brief: Testing directory. - - get_configuration: + - configuration: + type: dict + brief: Configuration values for ossec.conf. + - metadata: + type: dict + brief: Test case data. + - test_folders: + type: dict + brief: List of folders to be created for monitoring. + - set_wazuh_configuration: type: fixture - brief: Get configurations from the module. - - put_env_variables: + brief: Set ossec.conf configuration. + - create_monitored_folders_module: type: fixture - brief: Create environment variables. - - configure_environment: + brief: Create a given list of folders when the module starts. Delete the folders at the end of the module. + - configure_local_internal_options_function: type: fixture - brief: Configure a custom environment for testing. - - restart_syscheckd: + brief: Set local_internal_options.conf file. + - restart_syscheck_function: type: fixture - brief: Clear the 'ossec.log' file and start a new monitor. - - wait_for_fim_start: + brief: restart syscheckd daemon, and truncate the ossec.log. + - wait_syscheck_start: type: fixture - brief: Wait for realtime start, whodata start, or end of initial FIM scan. + brief: check that the starting FIM scan is detected. assertions: - - Verify that real-time file monitoring is active. + - Verify that real-time whodata thread active. - input_description: A test case is contained in external YAML file - (wazuh_conf_whodata_prevails_over_realtime.yaml) - which includes configuration settings for the 'wazuh-syscheckd' daemon - and testing directories to monitor. + input_description: The file 'configuration_whodata_prevails_over_realtime.yaml' provides the configuration + template. + The file 'cases_whodata_prevails_over_realtime.yaml' provides the tes cases configuration + details for each test case. expected_output: - r'.*Sending FIM event: (.+)$' tags: - - realtime - who_data ''' + wazuh_log_monitor = FileMonitor(LOG_FILE_PATH) filename = "testfile" - create_file(REGULAR, directory, filename, content="") + create_file(REGULAR, test_directories[0], filename, content="") event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout, callback=callback_detect_event).result() - if (event['data']['mode'] != 'whodata' and event['data']['type'] != 'added' and - os.path.join(directory, filename) in event['data']['path']): - raise AssertionError('Event not found') + assert event['data']['mode'] == 'whodata', f"Unexpected event mode found:{event['data']['mode']}, expected whodata" + assert event['data']['type'] == 'added', f"Unexpected event type found:{event['data']['type']}, expected added" + assert os.path.join(test_directories[0], filename) in event['data']['path'], 'Unexpected file path found' - delete_file(directory, filename) + delete_file(os.path.join(test_directories[0], filename)) event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout, callback=callback_detect_event).result() - if (event['data']['mode'] != 'whodata' and event['data']['type'] != 'deleted' and - os.path.join(directory, filename) in event['data']['path']): - raise AssertionError('Event not found') + assert event['data']['mode'] == 'whodata', f"Unexpected event mode found:{event['data']['mode']}, expected whodata" + assert event['data']['type'] == 'deleted', f"Unexpected event type found:{event['data']['type']}, expected deleted" + assert os.path.join(test_directories[0], filename) in event['data']['path'], 'Unexpected file path found' diff --git a/tests/integration/test_fim/test_files/test_inotify/data/wazuh_conf_num_watches.yaml b/tests/integration/test_fim/test_files/test_inotify/data/wazuh_conf_num_watches.yaml index 3840371b79..335fab9d09 100644 --- a/tests/integration/test_fim/test_files/test_inotify/data/wazuh_conf_num_watches.yaml +++ b/tests/integration/test_fim/test_files/test_inotify/data/wazuh_conf_num_watches.yaml @@ -11,7 +11,7 @@ - disabled: value: 'no' - frequency: - value: 30 + value: 15 - directories: value: TEST_DIRECTORIES attributes: diff --git a/tests/integration/test_fim/test_files/test_inotify/test_num_watches.py b/tests/integration/test_fim/test_files/test_inotify/test_num_watches.py index c4ecac73de..24c2081ca0 100644 --- a/tests/integration/test_fim/test_files/test_inotify/test_num_watches.py +++ b/tests/integration/test_fim/test_files/test_inotify/test_num_watches.py @@ -64,7 +64,7 @@ import sys import pytest -from wazuh_testing import global_parameters +from wazuh_testing import T_60 from wazuh_testing.fim import LOG_FILE_PATH, callback_num_inotify_watches, generate_params, detect_initial_scan from wazuh_testing.tools import PREFIX from wazuh_testing.tools.configuration import load_wazuh_configurations, check_apply_test @@ -205,8 +205,7 @@ def test_num_watches(realtime_enabled, decreases_num_watches, rename_folder, get # Check that the number of inotify watches is correct before modifying the folder try: - num_watches = wazuh_log_monitor.start(timeout=global_parameters.default_timeout, - callback=callback_num_inotify_watches, + num_watches = wazuh_log_monitor.start(timeout=T_60, callback=callback_num_inotify_watches, error_message='Did not receive expected ' '"Folders monitored with real-time engine: ..." event' ).result() @@ -239,8 +238,7 @@ def test_num_watches(realtime_enabled, decreases_num_watches, rename_folder, get try: # Check that the number of inotify watches is correct after modifying the folder - num_watches = wazuh_log_monitor.start(timeout=40, - callback=callback_num_inotify_watches, + num_watches = wazuh_log_monitor.start(timeout=T_60, callback=callback_num_inotify_watches, error_message='Did not receive expected ' '"Folders monitored with real-time engine: ..." event' ).result() @@ -270,8 +268,7 @@ def test_num_watches(realtime_enabled, decreases_num_watches, rename_folder, get for directory in test_directories: os.mkdir(directory) - num_watches = wazuh_log_monitor.start(timeout=40, - callback=callback_num_inotify_watches, + num_watches = wazuh_log_monitor.start(timeout=T_60, callback=callback_num_inotify_watches, error_message='Did not receive expected ' '"Folders monitored with real-time engine: ..." event' ).result() diff --git a/tests/integration/test_fim/test_files/test_max_eps/test_sync_max_eps_scheduled.py b/tests/integration/test_fim/test_files/test_max_eps/test_sync_max_eps_scheduled.py index c95a0ec595..30209d690b 100644 --- a/tests/integration/test_fim/test_files/test_max_eps/test_sync_max_eps_scheduled.py +++ b/tests/integration/test_fim/test_files/test_max_eps/test_sync_max_eps_scheduled.py @@ -70,7 +70,8 @@ from wazuh_testing.modules import DATA, TIER1, AGENT, WINDOWS, LINUX from wazuh_testing.modules.fim import TEST_DIR_1, TEST_DIRECTORIES, YAML_CONF_MAX_EPS_SYNC, SCHEDULED_MODE from wazuh_testing.modules.fim import FIM_DEFAULT_LOCAL_INTERNAL_OPTIONS as local_internal_options -from wazuh_testing.modules.fim.event_monitor import (callback_integrity_message, ERR_MSG_INTEGRITY_CONTROL_MSG, +from wazuh_testing.modules.fim.event_monitor import (callback_detect_integrity_check_global, + callback_integrity_sync_message, ERR_MSG_INTEGRITY_CONTROL_MSG, ERR_MSG_MULTIPLE_FILES_CREATION) from wazuh_testing.tools.file import delete_path_recursively, write_file from wazuh_testing.modules.fim.utils import generate_params @@ -127,6 +128,7 @@ def create_multiple_files(get_configuration): # Tests + def test_max_eps_sync_valid_within_range(configure_local_internal_options_module, get_configuration, create_multiple_files, configure_environment, restart_wazuh): ''' @@ -181,13 +183,13 @@ def test_max_eps_sync_valid_within_range(configure_local_internal_options_module # Find integrity start before attempting to read max_eps. wazuh_log_monitor.start(timeout=TIMEOUT_CHECK_INTEGRATY_START, - callback=callback_integrity_message, + callback=callback_detect_integrity_check_global, error_message=ERR_MSG_INTEGRITY_CONTROL_MSG).result() # Find integrity message for each file created after read max_eps. total_file_created = max_eps + 5 result = wazuh_log_monitor.start(timeout=TIMEOUT_CHECK_EACH_INTEGRITY_MSG, accum_results=total_file_created, - callback=callback_integrity_message, + callback=callback_integrity_sync_message, error_message=f'Received less results than expected\ ({total_file_created})').result() # Collect by time received the messages. diff --git a/tests/integration/test_fim/test_files/test_restrict/test_restrict_valid.py b/tests/integration/test_fim/test_files/test_restrict/test_restrict_valid.py index 9bbc21105e..d7b3f5c721 100644 --- a/tests/integration/test_fim/test_files/test_restrict/test_restrict_valid.py +++ b/tests/integration/test_fim/test_files/test_restrict/test_restrict_valid.py @@ -96,6 +96,7 @@ def get_configuration(request): return request.param +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('folder', test_directories) @pytest.mark.parametrize('filename, mode, content, triggers_event, tags_to_apply', [ ('.restricted', 'w', "Sample content", True, {'valid_regex1'}), diff --git a/tests/integration/test_fim/test_files/test_scan/test_scan_day.py b/tests/integration/test_fim/test_files/test_scan/test_scan_day.py index b26ce926dd..ef1459602d 100644 --- a/tests/integration/test_fim/test_files/test_scan/test_scan_day.py +++ b/tests/integration/test_fim/test_files/test_scan/test_scan_day.py @@ -64,6 +64,7 @@ - fim_scan ''' import os +import sys from datetime import datetime, timedelta import pytest @@ -104,9 +105,8 @@ def get_configuration(request): # tests -@pytest.mark.parametrize('tags_to_apply', [ - {'scan_day'} -]) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") +@pytest.mark.parametrize('tags_to_apply', [{'scan_day'}]) def test_scan_day(tags_to_apply, get_configuration, configure_environment, restart_syscheckd, wait_for_fim_start): diff --git a/tests/integration/test_fim/test_files/test_scan/test_scan_day_and_time.py b/tests/integration/test_fim/test_files/test_scan/test_scan_day_and_time.py index e04544298b..0109b9dd12 100644 --- a/tests/integration/test_fim/test_files/test_scan/test_scan_day_and_time.py +++ b/tests/integration/test_fim/test_files/test_scan/test_scan_day_and_time.py @@ -61,6 +61,7 @@ - fim_scan ''' import os +import sys from calendar import monthrange from datetime import datetime, timedelta @@ -137,9 +138,8 @@ def get_configuration(request): # tests -@pytest.mark.parametrize('tags_to_apply', [ - {'scan_both'} -]) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") +@pytest.mark.parametrize('tags_to_apply', [{'scan_both'}]) def test_scan_day_and_time(tags_to_apply, get_configuration, configure_environment, restart_syscheckd, wait_for_fim_start): diff --git a/tests/integration/test_fim/test_files/test_scan/test_scan_time.py b/tests/integration/test_fim/test_files/test_scan/test_scan_time.py index 28542fe911..e6b634c975 100644 --- a/tests/integration/test_fim/test_files/test_scan/test_scan_time.py +++ b/tests/integration/test_fim/test_files/test_scan/test_scan_time.py @@ -60,6 +60,7 @@ - fim_scan ''' import os +import sys from datetime import datetime, timedelta import pytest @@ -101,9 +102,8 @@ def get_configuration(request): # tests -@pytest.mark.parametrize('tags_to_apply', [ - {'scan_time'} -]) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") +@pytest.mark.parametrize('tags_to_apply', [{'scan_time'}]) def test_scan_time(tags_to_apply, get_configuration, configure_environment, restart_syscheckd, wait_for_fim_start): diff --git a/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_complex.py b/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_complex.py index 6c6b631de4..0cda62f769 100644 --- a/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_complex.py +++ b/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_complex.py @@ -56,6 +56,7 @@ - fim_registry_ambiguous_confs ''' import os +import sys from hashlib import sha1 import pytest @@ -126,10 +127,8 @@ def get_configuration(request): # Tests - -@pytest.mark.parametrize('key', [ - key -]) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") +@pytest.mark.parametrize('key', [key]) @pytest.mark.parametrize('subkey, key_checkers', [ (registry, checkers_key), (subkey_1, checkers_subkey1), @@ -198,9 +197,8 @@ def test_ambiguous_complex_checks(key, subkey, key_checkers, options=key_checkers, time_travel=True) -@pytest.mark.parametrize('key', [ - key -]) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") +@pytest.mark.parametrize('key', [key]) @pytest.mark.parametrize('subkey, value_list, report,', [ (registry, ['test_value'], True), (subkey_1, ['test_value'], False), @@ -283,9 +281,8 @@ def report_changes_validator(event): value_list=value_list, time_travel=True, validators_after_update=validator_after_update) -@pytest.mark.parametrize('key', [ - key -]) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") +@pytest.mark.parametrize('key', [key]) @pytest.mark.parametrize('subkey, tag', [ (registry, None), (subkey_1, tag_1), @@ -368,11 +365,9 @@ def tag_validator(event): # Test registry values. registry_key_cud(key, subkey, wazuh_log_monitor, min_timeout=global_parameters.default_timeout, time_travel=True, validators_after_create=validator_after_create, - validators_after_update=validator_after_update, validators_after_delete=validator_after_delete - ) + validators_after_update=validator_after_update, validators_after_delete=validator_after_delete) # Test registry values. registry_value_cud(key, subkey, wazuh_log_monitor, min_timeout=global_parameters.default_timeout, time_travel=True, validators_after_create=validator_after_create, - validators_after_update=validator_after_update, validators_after_delete=validator_after_delete - ) + validators_after_update=validator_after_update, validators_after_delete=validator_after_delete) diff --git a/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_duplicated_entries.py b/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_duplicated_entries.py index d16f64bc63..b93c6264d0 100644 --- a/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_duplicated_entries.py +++ b/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_duplicated_entries.py @@ -57,6 +57,7 @@ - fim_registry_ambiguous_confs ''' import os +import sys from hashlib import sha1 import pytest @@ -119,9 +120,8 @@ def get_configuration(request): # Tests -@pytest.mark.parametrize('key', [ - key -]) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") +@pytest.mark.parametrize('key', [key]) @pytest.mark.parametrize('subkey, arch, key_list, value_list, checkers, tags_to_apply', [ (subkey_1, KEY_WOW64_64KEY, ['random_key'], ['test_value'], key_all_attrs, {'duplicate_entries'}), (subkey_2, KEY_WOW64_64KEY, ['random_key'], ['test_value'], key_all_attrs, {'duplicate_entries'}), @@ -215,9 +215,8 @@ def test_duplicate_entries(key, subkey, arch, key_list, value_list, checkers, ta min_timeout=global_parameters.default_timeout, time_travel=True, triggers_event=True) -@pytest.mark.parametrize('key', [ - key -]) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") +@pytest.mark.parametrize('key', [key]) @pytest.mark.parametrize('subkey, arch, value_list, tags_to_apply, report_changes', [ (subkey_1, KEY_WOW64_64KEY, ['test_value'], {'duplicate_report_entries'}, True), (subkey_2, KEY_WOW64_64KEY, ['test_value'], {'duplicate_report_entries'}, False), diff --git a/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_simple.py b/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_simple.py index d59e1de7a5..44ffdee07d 100644 --- a/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_simple.py +++ b/tests/integration/test_fim/test_registry/test_registry_ambiguous_confs/test_registry_ambiguous_simple.py @@ -57,6 +57,7 @@ - fim_registry_ambiguous_confs ''' import os +import sys import pytest from wazuh_testing import global_parameters @@ -128,8 +129,6 @@ # Fixtures - - @pytest.fixture(scope='module', params=configurations) def get_configuration(request): """Get configurations from the module.""" @@ -137,7 +136,7 @@ def get_configuration(request): # Tests - +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('key, sub_keys, arch', [ (key, (subkey_1, os.path.join(subkey_1, key_name)), KEY_WOW64_64KEY), (key, (subkey_2, os.path.join(subkey_2, key_name)), KEY_WOW64_64KEY), @@ -215,6 +214,7 @@ def no_tag_validator(event): min_timeout=global_parameters.default_timeout, validators_after_cud=[no_tag_validator]) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('key, subkey, arch', [ (key, os.path.join(subkey_1, recursion_key), KEY_WOW64_64KEY), (key, os.path.join(subkey_2, recursion_key), KEY_WOW64_64KEY), @@ -284,6 +284,7 @@ def test_ambiguous_recursion(key, subkey, arch, time_travel=True, triggers_event=True, min_timeout=global_parameters.default_timeout) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('key, subkey, key_checkers, subkey_checkers', [ (key, (subkey_1, os.path.join(subkey_1, key_name)), checkers_key_case1, checkers_subkey_case1), (key, (subkey_2, os.path.join(subkey_2, key_name)), checkers_key_case2, checkers_subkey_case2) diff --git a/tests/integration/test_fim/test_registry/test_registry_basic_usage/data/wazuh_conf_reg_attr.yaml b/tests/integration/test_fim/test_registry/test_registry_basic_usage/data/wazuh_conf_reg_attr.yaml index 8a4220f76e..d281ec90b3 100644 --- a/tests/integration/test_fim/test_registry/test_registry_basic_usage/data/wazuh_conf_reg_attr.yaml +++ b/tests/integration/test_fim/test_registry/test_registry_basic_usage/data/wazuh_conf_reg_attr.yaml @@ -16,6 +16,8 @@ attributes: - ATTRIBUTE - arch: "64bit" + - frequency: + value: 3 - section: sca elements: - enabled: diff --git a/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_delete_registry.py b/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_delete_registry.py index 2af11d8747..e2c5cab7be 100644 --- a/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_delete_registry.py +++ b/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_delete_registry.py @@ -54,6 +54,7 @@ - fim_registry_basic_usage ''' import os +import sys from collections import Counter import pytest @@ -101,7 +102,7 @@ def get_configuration(request): # test - +@pytest.mark.skip(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('key, subkey, arch, value_list', [ (key, sub_key_1, KEY_WOW64_64KEY, ['value1', 'value2', 'value3']), (key, sub_key_2, KEY_WOW64_32KEY, ['value1', 'value2', 'value3']), diff --git a/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_entries_match_key_count.py b/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_entries_match_key_count.py index cfd5141b56..7d1fb7c8c7 100644 --- a/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_entries_match_key_count.py +++ b/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_entries_match_key_count.py @@ -56,12 +56,12 @@ import os import pytest -from wazuh_testing import global_parameters -from wazuh_testing.fim import LOG_FILE_PATH, generate_params, callback_registry_count_entries, \ - check_time_travel, create_registry, modify_registry_value, registry_parser, KEY_WOW64_64KEY, \ - REG_SZ, REG_MULTI_SZ, REG_DWORD +from wazuh_testing import T_20, LOG_FILE_PATH from wazuh_testing.tools.configuration import load_wazuh_configurations -from wazuh_testing.tools.monitoring import FileMonitor +from wazuh_testing.tools.monitoring import FileMonitor, generate_monitoring_callback +from wazuh_testing.modules.fim import registry_parser, KEY_WOW64_64KEY, REG_SZ, REG_MULTI_SZ, REG_DWORD +from wazuh_testing.modules.fim.utils import generate_params, create_registry, modify_registry_value +from wazuh_testing.modules.fim.event_monitor import CB_FIM_REGISTRY_ENTRIES_COUNT, CB_FIM_REGISTRY_VALUES_ENTRIES_COUNT # Marks @@ -147,14 +147,14 @@ def test_entries_match_key_count(get_configuration, configure_environment, resta - scheduled - time_travel ''' - entries = wazuh_log_monitor.start(timeout=global_parameters.default_timeout, - callback=callback_registry_count_entries, - error_message='Did not receive expected ' - '"Fim inode entries: ..., path count: ..." event' - ).result() - check_time_travel(True, monitor=wazuh_log_monitor) - - if entries: - assert entries == '4', 'Wrong number of entries' - else: - raise AssertionError('Wrong number of entries') + registry_entries = wazuh_log_monitor.start(timeout=T_20, update_position=False, + callback=generate_monitoring_callback(CB_FIM_REGISTRY_ENTRIES_COUNT), + error_message=f'Did not receive expected \ + "{CB_FIM_REGISTRY_ENTRIES_COUNT}" event').result() + + callback = generate_monitoring_callback(CB_FIM_REGISTRY_VALUES_ENTRIES_COUNT) + value_entries = wazuh_log_monitor.start(timeout=T_20, callback=callback, + error_message=f'Did not receive expected \ + "{CB_FIM_REGISTRY_VALUES_ENTRIES_COUNT}" event').result() + + assert int(registry_entries) + int(value_entries) == 4, 'Wrong number of entries' diff --git a/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_registry_new_key.py b/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_registry_new_key.py index edab9a49cb..cbde5c3e7b 100644 --- a/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_registry_new_key.py +++ b/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_basic_usage_registry_new_key.py @@ -55,6 +55,7 @@ - fim_registry_basic_usage ''' import os +import sys import pytest from wazuh_testing import global_parameters @@ -96,7 +97,7 @@ def get_configuration(request): # tests - +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") def test_new_key(get_configuration, configure_environment, restart_syscheckd, wait_for_fim_start): ''' description: Check if the 'wazuh-syscheckd' daemon generates events from a new monitored key after diff --git a/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_long_registry_path.py b/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_long_registry_path.py index 2a2ca8e5bc..1d6759bf96 100644 --- a/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_long_registry_path.py +++ b/tests/integration/test_fim/test_registry/test_registry_basic_usage/test_long_registry_path.py @@ -55,6 +55,7 @@ - fim_registry_basic_usage ''' import os +import sys import pytest from wazuh_testing import global_parameters @@ -98,6 +99,7 @@ def get_configuration(request): return request.param +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") def test_long_registry_path(get_configuration, configure_environment, restart_syscheckd, wait_for_fim_start): ''' description: Check if the 'wazuh-syscheckd' daemon generates events from monitored keys with long paths. diff --git a/tests/integration/test_fim/test_registry/test_registry_checks/test_registry_checkers.py b/tests/integration/test_fim/test_registry/test_registry_checks/test_registry_checkers.py index 8bade9852e..ef916139d5 100644 --- a/tests/integration/test_fim/test_registry/test_registry_checks/test_registry_checkers.py +++ b/tests/integration/test_fim/test_registry/test_registry_checks/test_registry_checkers.py @@ -55,6 +55,7 @@ - fim_registry_checks ''' import os +import sys import pytest from wazuh_testing import global_parameters @@ -137,9 +138,8 @@ def get_configuration(request): # Test -@pytest.mark.parametrize('key', [ - key -]) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") +@pytest.mark.parametrize('key', [key]) @pytest.mark.parametrize('subkey, arch, key_attrs, value_attrs, tags_to_apply, triggers_modification', [ (sub_key_1, KEY_WOW64_64KEY, key_all_attrs, value_all_attrs, {'check_all_yes'}, True), (sub_key_2, KEY_WOW64_32KEY, key_all_attrs, value_all_attrs, {'check_all_yes'}, True), diff --git a/tests/integration/test_fim/test_registry/test_registry_ignore/data/wazuh_registry_ignore_conf.yaml b/tests/integration/test_fim/test_registry/test_registry_ignore/data/wazuh_registry_ignore_conf.yaml index 3bf04bcd36..e434654d1d 100644 --- a/tests/integration/test_fim/test_registry/test_registry_ignore/data/wazuh_registry_ignore_conf.yaml +++ b/tests/integration/test_fim/test_registry/test_registry_ignore/data/wazuh_registry_ignore_conf.yaml @@ -30,6 +30,8 @@ value: WINDOWS_REGISTRY_2 attributes: - arch: '64bit' + - frequency: + value: 5 - section: sca elements: - enabled: @@ -75,6 +77,8 @@ value: WINDOWS_REGISTRY_2 attributes: - arch: '64bit' + - frequency: + value: 5 - section: sca elements: - enabled: diff --git a/tests/integration/test_fim/test_registry/test_registry_ignore/test_ignore_registry.py b/tests/integration/test_fim/test_registry/test_registry_ignore/test_ignore_registry.py index 2a8518c48f..17392174a8 100755 --- a/tests/integration/test_fim/test_registry/test_registry_ignore/test_ignore_registry.py +++ b/tests/integration/test_fim/test_registry/test_registry_ignore/test_ignore_registry.py @@ -54,9 +54,10 @@ - fim_registry_ignore ''' import os +import sys import pytest -from wazuh_testing import global_parameters, fim +from wazuh_testing import T_20, fim from wazuh_testing.tools.configuration import load_wazuh_configurations, check_apply_test from wazuh_testing.tools.monitoring import FileMonitor @@ -190,17 +191,15 @@ def test_ignore_registry_key(root_key, registry, arch, subkey, triggers_event, t - time_travel ''' check_apply_test(tags_to_apply, get_configuration['tags']) - scheduled = get_configuration['metadata']['fim_mode'] == 'scheduled' fim.registry_ignore_path = os.path.join(root_key, registry) # Create registry fim.create_registry(fim.registry_parser[root_key], os.path.join(registry, subkey), arch) - # Go ahead in time to let syscheck perform a new scan - fim.check_time_travel(scheduled, monitor=wazuh_log_monitor) + # Let syscheck perform a new scan if triggers_event: - event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout, + event = wazuh_log_monitor.start(timeout=T_20, callback=fim.callback_key_event, error_message='Did not receive expected ' '"Sending FIM event: ..." event').result() @@ -210,7 +209,7 @@ def test_ignore_registry_key(root_key, registry, arch, subkey, triggers_event, t else: with pytest.raises(TimeoutError): - event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout, + event = wazuh_log_monitor.start(timeout=T_20, callback=fim.callback_key_event, error_message='Did not receive expected ' '"Sending FIM event: ..." event').result() @@ -293,19 +292,16 @@ def test_ignore_registry_value(root_key, registry, arch, value, triggers_event, - time_travel ''' check_apply_test(tags_to_apply, get_configuration['tags']) - scheduled = get_configuration['metadata']['fim_mode'] == 'scheduled' + # Open the key (this shouldn't create an alert) key_h = fim.create_registry(fim.registry_parser[root_key], registry, arch) # Create values fim.modify_registry_value(key_h, value, fim.REG_SZ, "test_value") - # Go ahead in time to let syscheck perform a new scan - fim.check_time_travel(scheduled, monitor=wazuh_log_monitor) + # Let syscheck perform a new scan if triggers_event: - event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout, - callback=fim.callback_value_event, - error_message='Did not receive expected ' - '"Sending FIM event: ..." event').result() + event = wazuh_log_monitor.start(timeout=T_20, callback=fim.callback_value_event, + error_message='Did not receive expected "Sending FIM event:.." event').result() assert event['data']['type'] == 'added', 'Wrong event type.' assert event['data']['path'] == os.path.join(root_key, registry), 'Wrong value path.' @@ -314,7 +310,6 @@ def test_ignore_registry_value(root_key, registry, arch, value, triggers_event, else: with pytest.raises(TimeoutError): - event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout, - callback=fim.callback_value_event, + event = wazuh_log_monitor.start(timeout=T_20, callback=fim.callback_value_event, error_message='Did not receive expected ' '"Sending FIM event: ..." event').result() diff --git a/tests/integration/test_fim/test_registry/test_registry_limit/data/wazuh_conf.yaml b/tests/integration/test_fim/test_registry/test_registry_limit/data/wazuh_conf.yaml index a2dcec0394..561a04cc46 100644 --- a/tests/integration/test_fim/test_registry/test_registry_limit/data/wazuh_conf.yaml +++ b/tests/integration/test_fim/test_registry/test_registry_limit/data/wazuh_conf.yaml @@ -11,7 +11,7 @@ - disabled: value: 'no' - frequency: - value: 5 + value: 3 - windows_registry: value: WINDOWS_REGISTRY attributes: @@ -52,7 +52,7 @@ - disabled: value: 'no' - frequency: - value: 5 + value: 3 - windows_registry: value: WINDOWS_REGISTRY_1 attributes: @@ -97,7 +97,7 @@ - disabled: value: 'no' - frequency: - value: 5 + value: 3 - windows_registry: value: WINDOWS_REGISTRY_1 attributes: diff --git a/tests/integration/test_fim/test_registry/test_registry_multiple_registries/test_multiple_keys.py b/tests/integration/test_fim/test_registry/test_registry_multiple_registries/test_multiple_keys.py index c561ae4a69..ab6b4cfcf6 100644 --- a/tests/integration/test_fim/test_registry/test_registry_multiple_registries/test_multiple_keys.py +++ b/tests/integration/test_fim/test_registry/test_registry_multiple_registries/test_multiple_keys.py @@ -54,6 +54,7 @@ - fim_registry_multiple_registries ''' import os +import sys import time import pytest @@ -102,11 +103,8 @@ def get_configuration(request): # Test - - -@pytest.mark.parametrize('tags_to_apply', [ - ({'multiple_keys'}) -]) +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") +@pytest.mark.parametrize('tags_to_apply', [({'multiple_keys'})]) def test_multiple_keys(tags_to_apply, get_configuration, configure_environment, restart_syscheckd): ''' description: Check if the 'wazuh-syscheckd' daemon detects every event when adding, modifying, and deleting diff --git a/tests/integration/test_fim/test_registry/test_registry_nodiff/test_registry_no_diff.py b/tests/integration/test_fim/test_registry/test_registry_nodiff/test_registry_no_diff.py index 8a2bbb16cc..b043c91164 100644 --- a/tests/integration/test_fim/test_registry/test_registry_nodiff/test_registry_no_diff.py +++ b/tests/integration/test_fim/test_registry/test_registry_nodiff/test_registry_no_diff.py @@ -54,6 +54,7 @@ - fim_registry_nodiff ''' import os +import sys from hashlib import sha1 from time import sleep @@ -107,6 +108,7 @@ def get_configuration(request): return request.param +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('key, subkey, arch, value_name, truncated, tags_to_apply', [ (key, sub_key_1, KEY_WOW64_64KEY, no_diff_value, True, {'no_diff_str'}), (key, sub_key_1, KEY_WOW64_64KEY, "some_value", False, {'no_diff_str'}), diff --git a/tests/integration/test_fim/test_registry/test_registry_report_changes/data/wazuh_registry_report_changes.yaml b/tests/integration/test_fim/test_registry/test_registry_report_changes/data/wazuh_registry_report_changes.yaml index a1f00f85d2..d461d5f17b 100644 --- a/tests/integration/test_fim/test_registry/test_registry_report_changes/data/wazuh_registry_report_changes.yaml +++ b/tests/integration/test_fim/test_registry/test_registry_report_changes/data/wazuh_registry_report_changes.yaml @@ -21,6 +21,8 @@ attributes: - arch: '64bit' - report_changes: 'yes' + - frequency: + value: 3 - section: sca elements: - enabled: diff --git a/tests/integration/test_fim/test_registry/test_registry_report_changes/test_disk_quota/test_registry_disk_quota_values.py b/tests/integration/test_fim/test_registry/test_registry_report_changes/test_disk_quota/test_registry_disk_quota_values.py index cf100fe75e..70a585a0b7 100644 --- a/tests/integration/test_fim/test_registry/test_registry_report_changes/test_disk_quota/test_registry_disk_quota_values.py +++ b/tests/integration/test_fim/test_registry/test_registry_report_changes/test_disk_quota/test_registry_disk_quota_values.py @@ -55,6 +55,7 @@ - fim_registry_report_changes """ import os +import sys import pytest from wazuh_testing import LOG_FILE_PATH, global_parameters @@ -103,6 +104,7 @@ def get_configuration(request): return request.param +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize("size", [(4096), (32768)]) @pytest.mark.parametrize("key, subkey, arch, value_name", [ diff --git a/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_diff_size_limit_values.py b/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_diff_size_limit_values.py index 1379b1f72a..b43d195b0f 100644 --- a/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_diff_size_limit_values.py +++ b/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_diff_size_limit_values.py @@ -55,6 +55,7 @@ - fim_registry_report_changes ''' import os +import sys import pytest from wazuh_testing import LOG_FILE_PATH, global_parameters @@ -98,6 +99,7 @@ def get_configuration(request): return request.param +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('size', [(4096), (16384)]) @pytest.mark.parametrize('key, subkey, arch, value_name', [ (WINDOWS_HKEY_LOCAL_MACHINE, MONITORED_KEY, KEY_WOW64_64KEY, 'some_value'), diff --git a/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_file_size_values.py b/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_file_size_values.py index 3cb4d60755..656579944d 100644 --- a/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_file_size_values.py +++ b/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_file_size_values.py @@ -55,6 +55,7 @@ - fim_registry_report_changes ''' import os +import sys import pytest from wazuh_testing import global_parameters @@ -100,6 +101,7 @@ def get_configuration(request): return request.param +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('size', [(4096), (16384)]) @pytest.mark.parametrize('key, subkey, arch, value_name', [ (WINDOWS_HKEY_LOCAL_MACHINE, MONITORED_KEY, KEY_WOW64_64KEY, "some_value"), diff --git a/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_report_changes.py b/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_report_changes.py index c00e5c2273..4bcba3d8e8 100644 --- a/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_report_changes.py +++ b/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_report_changes.py @@ -55,6 +55,7 @@ - fim_registry_report_changes ''' import os +import sys import pytest from wazuh_testing import global_parameters @@ -100,6 +101,7 @@ def get_configuration(request): return request.param +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('key, subkey, arch, value_name, tags_to_apply', [ (key, sub_key_1, KEY_WOW64_64KEY, "some_value", {'test_report_changes'}), (key, sub_key_1, KEY_WOW64_32KEY, "some_value", {'test_report_changes'}), diff --git a/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_report_changes_more_changes.py b/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_report_changes_more_changes.py index f8cea6ede6..ede6173908 100644 --- a/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_report_changes_more_changes.py +++ b/tests/integration/test_fim/test_registry/test_registry_report_changes/test_registry_report_changes_more_changes.py @@ -55,6 +55,7 @@ - fim_registry_report_changes ''' import os +import sys import pytest from test_fim.common import generate_string @@ -103,6 +104,7 @@ def get_configuration(request): return request.param +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('key, subkey, arch, value_name, tags_to_apply', [ (key, sub_key_1, KEY_WOW64_64KEY, "some_value", {'test_report_changes'}), (key, sub_key_1, KEY_WOW64_32KEY, "some_value", {'test_report_changes'}), diff --git a/tests/integration/test_fim/test_registry/test_registry_restrict/data/wazuh_restrict_conf.yaml b/tests/integration/test_fim/test_registry/test_registry_restrict/data/wazuh_restrict_conf.yaml index 153ba96a4b..253a444559 100644 --- a/tests/integration/test_fim/test_registry/test_registry_restrict/data/wazuh_restrict_conf.yaml +++ b/tests/integration/test_fim/test_registry/test_registry_restrict/data/wazuh_restrict_conf.yaml @@ -20,6 +20,8 @@ attributes: - arch: "both" - restrict_value: RESTRICT_VALUE + - frequency: + value: 3 - section: sca elements: - enabled: @@ -55,6 +57,8 @@ attributes: - arch: "both" - restrict_key: RESTRICT_KEY + - frequency: + value: 3 - section: sca elements: - enabled: diff --git a/tests/integration/test_fim/test_registry/test_registry_restrict/test_registry_restrict.py b/tests/integration/test_fim/test_registry/test_registry_restrict/test_registry_restrict.py index 69d97e2989..9b13211aa0 100644 --- a/tests/integration/test_fim/test_registry/test_registry_restrict/test_registry_restrict.py +++ b/tests/integration/test_fim/test_registry/test_registry_restrict/test_registry_restrict.py @@ -55,6 +55,7 @@ - fim_registry_restrict ''' import os +import sys import pytest from wazuh_testing import global_parameters @@ -104,6 +105,7 @@ def get_configuration(request): return request.param +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('key, subkey, arch, value_name, triggers_event, tags_to_apply', [ (key, sub_key_1, KEY_WOW64_64KEY, valid_value_name, True, {'value_restrict'}), (key, sub_key_2, KEY_WOW64_32KEY, valid_value_name, True, {'value_restrict'}), diff --git a/tests/integration/test_fim/test_registry/test_registry_tags/test_registry_tags.py b/tests/integration/test_fim/test_registry/test_registry_tags/test_registry_tags.py index 7fb51a1bf3..afcc2baa43 100644 --- a/tests/integration/test_fim/test_registry/test_registry_tags/test_registry_tags.py +++ b/tests/integration/test_fim/test_registry/test_registry_tags/test_registry_tags.py @@ -51,6 +51,7 @@ 2: Only level 2 tests are performed, they check advanced functionalities and are slow to perform. ''' import os +import sys import pytest from wazuh_testing import global_parameters @@ -89,6 +90,7 @@ def get_configuration(request): return request.param +@pytest.mark.skipif(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('key, subkey, arch', [ (key, sub_key, KEY_WOW64_32KEY), (key, sub_key, KEY_WOW64_64KEY), diff --git a/tests/integration/test_fim/test_synchronization/data/wazuh_conf_integrity_scan_win32.yaml b/tests/integration/test_fim/test_synchronization/data/wazuh_conf_integrity_scan_win32.yaml index 061a59341f..362bd79aba 100644 --- a/tests/integration/test_fim/test_synchronization/data/wazuh_conf_integrity_scan_win32.yaml +++ b/tests/integration/test_fim/test_synchronization/data/wazuh_conf_integrity_scan_win32.yaml @@ -8,7 +8,7 @@ - disabled: value: 'no' - frequency: - value: 40 + value: 20 - directories: value: TEST_DIRECTORIES attributes: diff --git a/tests/integration/test_fim/test_synchronization/test_registry_responses_win32.py b/tests/integration/test_fim/test_synchronization/test_registry_responses_win32.py index d4254cd359..a9f7940a79 100644 --- a/tests/integration/test_fim/test_synchronization/test_registry_responses_win32.py +++ b/tests/integration/test_fim/test_synchronization/test_registry_responses_win32.py @@ -55,6 +55,7 @@ - fim_synchronization ''' import os +import sys import pytest from wazuh_testing import LOG_FILE_PATH, DATA, WAZUH_SERVICES_START from wazuh_testing.tools.configuration import load_wazuh_configurations @@ -92,6 +93,7 @@ def get_configuration(request): # tests +@pytest.mark.skip(sys.platform=='win32', reason="Blocked by #4077.") @pytest.mark.parametrize('key_name', [':subkey1', 'subkey2:', ':subkey3:']) @pytest.mark.parametrize('value_name', [':value1', 'value2:', ':value3:']) def test_registry_sync_after_restart(key_name, value_name, configure_local_internal_options_module, diff --git a/tests/integration/test_fim/test_synchronization/test_sync_overlap.py b/tests/integration/test_fim/test_synchronization/test_sync_overlap.py index 97ffbd0423..5fd09dd820 100644 --- a/tests/integration/test_fim/test_synchronization/test_sync_overlap.py +++ b/tests/integration/test_fim/test_synchronization/test_sync_overlap.py @@ -60,6 +60,7 @@ - fim_synchronization ''' import os +import sys import pytest from wazuh_testing import global_parameters @@ -159,6 +160,8 @@ def test_sync_overlap(configuration, metadata, set_wazuh_configuration, configur tags: - scheduled ''' + if sys.platform == 'win32' and metadata['lower']: + pytest.xfail("It will be blocked by wazuh/wazuh-qa#4071") wazuh_log_monitor = FileMonitor(LOG_FILE_PATH) diff --git a/tests/integration/test_fim/test_synchronization/test_synchronize_integrity_win32.py b/tests/integration/test_fim/test_synchronization/test_synchronize_integrity_win32.py index f150053880..972fd48a1a 100644 --- a/tests/integration/test_fim/test_synchronization/test_synchronize_integrity_win32.py +++ b/tests/integration/test_fim/test_synchronization/test_synchronize_integrity_win32.py @@ -65,7 +65,8 @@ from wazuh_testing.modules import TIER2, WINDOWS from wazuh_testing.modules.fim import (WINDOWS_HKEY_LOCAL_MACHINE, KEY_WOW64_64KEY, registry_parser, REG_SZ, MONITORED_KEY) -from wazuh_testing.modules.fim.event_monitor import (callback_detect_event, callback_real_time_whodata_started, +from wazuh_testing.modules.fim.event_monitor import (callback_detect_event, callback_detect_file_added_event, + callback_real_time_whodata_started, callback_detect_synchronization, ERR_MSG_FIM_EVENT_NOT_RECIEVED, ERR_MSG_INTEGRITY_OR_WHODATA_NOT_STARTED, ERR_MSG_INTEGRITY_CHECK_EVENT) @@ -83,7 +84,7 @@ directory_str = ','.join(test_directories) test_data_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') configurations_path = os.path.join(test_data_path, 'wazuh_conf_integrity_scan_win32.yaml') -conf_params = {'TEST_DIRECTORIES': test_directories, +conf_params = {'TEST_DIRECTORIES': directory_str, 'TEST_REGS': os.path.join(WINDOWS_HKEY_LOCAL_MACHINE, subkey)} file_list = [] @@ -177,11 +178,11 @@ def test_events_while_integrity_scan(get_configuration, configure_environment, r # Wait for whodata to start and the synchronization check. Since they are different threads, we cannot expect # them to come in order every time if get_configuration['metadata']['fim_mode'] == 'whodata': - value_1 = wazuh_log_monitor.start(timeout=global_parameters.default_timeout * 3, + value_1 = wazuh_log_monitor.start(timeout=global_parameters.default_timeout * 5, callback=callback_integrity_or_whodata, error_message=ERR_MSG_INTEGRITY_OR_WHODATA_NOT_STARTED).result() - value_2 = wazuh_log_monitor.start(timeout=global_parameters.default_timeout * 3, + value_2 = wazuh_log_monitor.start(timeout=global_parameters.default_timeout * 5, callback=callback_integrity_or_whodata, error_message=ERR_MSG_INTEGRITY_OR_WHODATA_NOT_STARTED).result() assert value_1 != value_2, "callback_integrity_or_whodata detected the same message twice" @@ -197,12 +198,14 @@ def test_events_while_integrity_scan(get_configuration, configure_environment, r create_file(REGULAR, folder, file_name, content='') modify_registry_value(key_h, "test_value", REG_SZ, 'added') - sending_event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout*5, callback=callback_detect_event, + sending_event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout*5, + callback=callback_detect_file_added_event, error_message=ERR_MSG_FIM_EVENT_NOT_RECIEVED).result() assert sending_event['data']['path'] == os.path.join(folder, file_name) time.sleep(global_parameters.default_timeout) - sending_event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout*5, callback=callback_detect_event, + sending_event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout*5, + callback=callback_detect_event, error_message=ERR_MSG_FIM_EVENT_NOT_RECIEVED).result() assert sending_event['data']['path'] == os.path.join(WINDOWS_HKEY_LOCAL_MACHINE, subkey) assert sending_event['data']['arch'] == '[x64]' From 56666ee288dc16852b54a7ef761a1034557855cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mauro=20Agust=C3=ADn=20Malara=20Zapata?= <39094716+mauromalara@users.noreply.github.com> Date: Wed, 24 May 2023 14:15:11 -0300 Subject: [PATCH 34/34] Improve the way that environment data is managed (#4059) * feat(#4058): remove the default credentials from code. * fix(#4059): fix importing a symbol instead of real var. * docs(#4059): add change to the changelog. * style(#4059): remove unused imports and fix CHANGELOG --- CHANGELOG.md | 2 ++ .../tools/migration_tool/__init__.py | 8 +------ .../tools/migration_tool/utils.py | 24 +++++++++---------- 3 files changed, 14 insertions(+), 20 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b5bf6da3c2..3e27a53755 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,8 @@ All notable changes to this project will be documented in this file. - Add new module to support migration tool. ([#3837](https://github.com/wazuh/wazuh-qa/pull/3837)) ### Changed + +- Improve the way that environment data is managed ([#4059](https://github.com/wazuh/wazuh-qa/pull/4059)) \- (Framework) - Update FIM test_ambiguous_confs IT to new framework ([#4121](https://github.com/wazuh/wazuh-qa/pull/4121)) \- (Tests + Framework) - Update `test_logcollector` invalid configs log level ([#4094](https://github.com/wazuh/wazuh-qa/pull/4094)) \- (Tests) - Update `test_office365` to support the new tag `API_TYPE` ([#4065](https://github.com/wazuh/wazuh-qa/pull/4065)) \- (Framework + Tests) diff --git a/deps/wazuh_testing/wazuh_testing/tools/migration_tool/__init__.py b/deps/wazuh_testing/wazuh_testing/tools/migration_tool/__init__.py index f425b1045f..7fa83e98e9 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/migration_tool/__init__.py +++ b/deps/wazuh_testing/wazuh_testing/tools/migration_tool/__init__.py @@ -16,13 +16,7 @@ SNAPSHOTS_DIR = f"{GENERATED_FILES_DIR}/snapshots" DOWNLOADS_DIR = f"{GENERATED_FILES_DIR}/downloads" UNCOMPRESSED_DIR = f"{GENERATED_FILES_DIR}/uncompressed" -MYSQL_CREDENTIALS = { - 'user': None, - 'password': None, - 'host': None, - 'port': None, - 'database': None -} +MYSQL_CREDENTIALS = None # Callback messages CB_PROCESS_STARTED = r'.+\[info\]\[Orchestrator - start\]: Starting process' diff --git a/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py b/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py index 8d73e6f013..64f8f3f4b1 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py +++ b/deps/wazuh_testing/wazuh_testing/tools/migration_tool/utils.py @@ -12,9 +12,7 @@ from jsonschema.exceptions import ValidationError from mysql.connector import errorcode -from wazuh_testing.tools.migration_tool import MIGRATION_TOOL_PATH, CVE5_SCHEMA_PATH, DELTA_SCHEMA_PATH, \ - ERROR_MESSAGES, SNAPSHOTS_DIR, DOWNLOADS_DIR, MIGRATION_TOOL_LOG_PATH, \ - MYSQL_CREDENTIALS, UNCOMPRESSED_DIR +import wazuh_testing.tools.migration_tool as migration_tool from wazuh_testing.tools.file import delete_all_files_in_folder, read_json_file, truncate_file from wazuh_testing.tools.logging import Logging @@ -42,11 +40,11 @@ def run_tool(cmd): return out, err for file_path in config_files: - truncate_file(MIGRATION_TOOL_LOG_PATH) - command = ' '.join([MIGRATION_TOOL_PATH, '-i', file_path, args]) + truncate_file(migration_tool.MIGRATION_TOOL_LOG_PATH) + command = ' '.join([migration_tool.MIGRATION_TOOL_PATH, '-i', file_path, args]) output, _ = run_tool(command) output = output.decode() - error_checker = [True for msg in ERROR_MESSAGES if msg in output] + error_checker = [True for msg in migration_tool.ERROR_MESSAGES if msg in output] if len(error_checker) > 0: errors += f"\n{output}" @@ -113,7 +111,7 @@ def validate_against_delta_schema(_elements): _result = True _errors = [] for cve in _elements: - _result, _error = validate_json_against_schema(cve, DELTA_SCHEMA_PATH) + _result, _error = validate_json_against_schema(cve, migration_tool.DELTA_SCHEMA_PATH) if _result is False: _errors.append(_error) @@ -131,7 +129,7 @@ def validate_against_cve5_schema(_elements): for cves in _elements: data = json.loads(cves['data_blob']) - _result, _error = validate_json_against_schema(data, CVE5_SCHEMA_PATH) + _result, _error = validate_json_against_schema(data, migration_tool.CVE5_SCHEMA_PATH) if _result is False: _errors.append(_error) @@ -149,10 +147,10 @@ def query_publisher_db(query): try: connection = mysql.connector.connect( - host=MYSQL_CREDENTIALS['host'], - user=MYSQL_CREDENTIALS['user'], - password=MYSQL_CREDENTIALS['password'], - database=MYSQL_CREDENTIALS['database'] + host=migration_tool.MYSQL_CREDENTIALS['host'], + user=migration_tool.MYSQL_CREDENTIALS['user'], + password=migration_tool.MYSQL_CREDENTIALS['password'], + database=migration_tool.MYSQL_CREDENTIALS['database'] ) except mysql.connector.Error as error: connection = None @@ -175,7 +173,7 @@ def query_publisher_db(query): def clean_migration_tool_output_files(): '''Remove all files generated by Content Migration Tool. ''' - output_folders = [SNAPSHOTS_DIR, DOWNLOADS_DIR, UNCOMPRESSED_DIR] + output_folders = [migration_tool.SNAPSHOTS_DIR, migration_tool.DOWNLOADS_DIR, migration_tool.UNCOMPRESSED_DIR] for output_folder in output_folders: for folder in vendors: